24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T50a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.SalityStub — Falcon Sandbox Report — Score 100/100 — Sample 37f1b6394a40…","description":"Malicious verdict for sandbox report 5dc2e02f0288…. Malware family: Trojan.SalityStub. Threat score 100/100. 12 malicious and 18 suspicious behavioral indicators across 60 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4/5dc2e02f0288384a2de46612","keywords":["Malicious","Trojan.SalityStub","sandbox report","malware analysis","MITRE ATT\u0026CK","37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4"],"about":{"@type":"SoftwareApplication","name":"darfrp.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.SalityStub","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":12,"suspicious":18,"totalSignatures":60},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==26:T4e6,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "CLSID_ExecuteFolder" (Path: "HKCU\CLSID\{11DBB47C-A525-400B-9E80-A54615A090C0}\INPROCSERVER32") ".exe" touched "ShellWindows" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}") ".exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") ".exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") ".exe" touched "CLSID_DesktopExplorerHost" (Path: "HKCU\CLSID\{682159D9-C321-47CA-B3F1-30E36B2EC8B9}\TREATAS") ".exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\TREATAS") "dwm.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "dwm.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "dwm.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS")27:T477,Process "explorer.exe" (UID: 00016671-00001552) was launched with new environment variables: "SESSIONNAME="Console"" Process "explorer.exe" (UID: 00016671-00001552) was launched with modified environment variables: "Path" Process "conhost.exe" (UID: 00016673-00001692) was launched with modified environment variables: "Path, TEMP, TMP, USERNAME" Process "conhost.exe" (UID: 00016673-00001692) was launched with missing environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC" Process "rundll32.exe" (UID: 00017341-00002848) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Local", COMPUTERNAME="H6FnFQnUZB", USERDOMAIN="H6FnFQnUZB", ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", APPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Roaming", USERPROFILE="C:\Windows\ServiceProfiles\LocalService", PUBLIC="C:\Users\Public"" Process "rundll32.exe" (UID: 00017341-00002848) was launched with modified environment variables: "TEMP, TMP, USERNAME"28:T633,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\3ae6eb" ".exe" touched file "C:\Windows\mkwsklc.log" ".exe" touched file "C:\Windows\system.ini" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Users\Rs76WHR\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" ".exe" touched file "C:\Windows\System32\ieframe.dll" ".exe" touched file "C:\Windows\System32\stdole2.tlb" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" ".exe" touched file "%APPDATA%\Microsoft\Windows\Libraries\desktop.ini" ".exe" touched file "%APPDATA%\Microsoft\Windows\Recent\desktop.ini" "taskhost.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\container.dat" "taskhost.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\container.dat" "dwm.exe" touched file "C:\Windows\46fae" "dwm.exe" touched file "C:\Windows\mkwsklc.log"29:T4bb,".exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "ENABLEFIREWALL"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "DONOTALLOWEXCEPTIONS"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "DISABLENOTIFICATIONS"; Value: "01000000") "dwm.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "ENABLEFIREWALL"; Value: "00000000") "dwm.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "DONOTALLOWEXCEPTIONS"; Value: "00000000") "dwm.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE"; Key: "DISABLENOTIFICATIONS"; Value: "01000000") "dwm.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")2a:T668,".exe" wrote 8192 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 516) ".exe" wrote 4096 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 516) ".exe" wrote 8192 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 556) ".exe" wrote 4096 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 556) ".exe" wrote 8192 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 584) ".exe" wrote 4096 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 584) ".exe" wrote 8192 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 640) ".exe" wrote 4096 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 640) ".exe" wrote 8192 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 644) ".exe" wrote 4096 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 644) ".exe" wrote 8192 bytes to a remote process "C:\kithj.pif.exe" (Handle: 716) ".exe" wrote 4096 bytes to a remote process "C:\kithj.pif.exe" (Handle: 716) ".exe" wrote 8192 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 744) ".exe" wrote 4096 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 744) "dwm.exe" wrote 8192 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 672) "dwm.exe" wrote 4096 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 672)2b:T908,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLOVERRIDE"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLOVERRIDE"; Value: "01000000") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLOVERRIDE"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLOVERRIDE"; Value: "01000000") "dwm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000")2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:Tb838,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uy9f8jW9dvffyCuhbQWIuHCtRDnIqSJdzhpIU4kQkSchEiEayIirjXnxIlIJE6iNXEiIdKciAtxzjnX1zXXXB8/1t39WXc1ERFxEiISIhIiERLit+/dd58dz+f7uo7rfF3npV3q48njj6vzx/u3XcfD93k+jYgPlT4yXokryhfKBUUzRnlaiY+UMo8pzyixWSk34/7IV8o9y6HMli2RmThR8JMS72cmTIhMxB7Bz2BDTpwQbL0RB5TvlJXKyGXlyhFjwwZh82Zh507h3/5bYdcuYds24V/8C2H9euEf/2Nh1Sph6VLh7/094e/+XWH6dOFv/s2Kv/E3hL/214Tx44W/8leEceOEv/yXhb/0lwRb1F//68LkycLf+lsVU6YIf/tvC3/n7wivvCL8w38o/NN/KrzzjvCv/pXwL/+lYOfXnrX3bt0q/PN/Lrz1lrB6tfCP/pFg18Y/+SeCvdj4B/9A+Pt/X7ALyc5Rmd/1kVHy//13NHf+LB4ujhzpnaYD+7/JPUkQcneC5CA5SA6Sg+QgOUgOkoPkDC05dyL+yG9oBXfizh/p/mfTi5sWheQQJAfJQXKQHCQHyUFykBwkB8lBcpAcguQgOUgOkoPkIDlIDpKD5CA5SA4hSA6Sg+QgOUgOkoPkIDlIDpKD5BDywOdG5tSpyES8rnyQsd/OEW8JT4UQK5SDgorZZ58JNiKuWCE8/7xw4IDwxhuC6UQ8LkyaJNhWLV4s2IwUsUZ4Ogp27BBilhL7MrZVTz4p2EAVTwg2t3/0kWAHx3LzptDJGeWyMDYEi3v4EsVtSxmV+at/VfiTPxFefVX4Z/9M+Nf/WvgP/0E4eVL46quKP/1T4fe/F+yP9+efV9QvthX94Q/Cl18K9mJblO2gubXx3/97xaefCvbeXybsAvufTv1svd7/+l+Fo0eFgweFf/NvhL17BfsTu3+/8O/+nfDv/73wn/+z8F/+i2Ab+fHHwn/6T8J//I8ZvvZNCMUDhCA5SA6Sg+QgOUgOkkMIQXIIQXKQHCQHyUFykBwkhxCC5BCC5CA5SA6Sg+QgOUgOIUgOIQTJQXKQHCQHyUFykBxCkBzy0GfsWMHy3XfC9u3Cu+8KMU547z3hp5+EtWsF+5W6bp0Q8XPGaoEao9Pn9BBie+aHHyJjQ/CNG5GxriYv8rIR+UmlnJiXLRPsLFizkeWTT4Q9e4QhJnU9odevCxZ79oknhE6L3XpFdSLOZ+x0f/ihEC8KR44IERczP/8cmU6N2z7lsCLyfPx4ZCxTpwqWc+cEH78OH64wYbBnbVH/z/8j2LM2MtpQeOyYYIuyA21Tr73XnjXsGv1v/034H/+jwnTCFMjmeDtntiLb5noX6kNnB0fn6Xra9hXZkm2srwWptqlaY2z3a52wM2jP2pVji7KTUp8jW5Et2dZr56g8ZYyYhCA5v6bPysRcutjLogYraRxV5Y1IDpKD5CA5SA6Sg+QgOYSQkZec3qvbe3SDwRY45Nt7X3vTorovRnKQHCQHyUFykBwkB8lBcgh5wCWnRwHoXXIG/E8kB8lBcpAcJAfJQXKQHCSHEPKbSU73wcFuzgx5x2ZAyem+sb6bVJhYvajBFovnIDlIDpKD5CA5SA6Sg+QQ8rBLzmDmM+QXZrqP9/jGHu8ODbmoXqyJNMd6rjrOszFjz06eLPjoFh9lrlyJTDyjaJGX/Ya1xrCI0xnr5jJvsR6zzpT/oXI08/33kekcnK0ZawkyYbDWLy8909hw0mkMk8Hd2sbiOSW+zXS0TeZ4K5ez/d25U4ipgr24IzmSxx4TTDZszrElX7wojBkjfPCBMJQPv5oxTf32W+HMGcFdS69nO842T5ov+dRrc209q9V9U7aoevq0gbKea+3F9bRtZmI1X3a511OvbZVhe2RCWNdt1ROz7a/JldHU+WZHw46VjfWG7ZH5Um0XtbbV16S916TOxNu2yk6KvffQIcHa1exZK2ozrPOt/LsDRkxC7tPv5AwoJ72LRy8L7P3zbD2+BclBcpAcJAfJQXKQHCQHySEEyenpxstgrxzQZwbzh7skOUNuA5KD5CA5SA6Sg+QgOUgOkkMIkjPwp9R6/FrLPZac4bUUIDlIDpKD5CA5SA6Sg+QgOYQ8pJJTNwr08mm04X2Rpkdv6WUbaFdDcpAcJAfJQXKQHCQHySGE7+QM0WPW1K7WYyXagMvv5ebMkNswjH+xhwwd65uKmJ/ZujUyEYsz5g/eJxa3lasZ+6Vps6kRcTJjU+/EicKPPwpWELdmjRCPCVZcFnFEke41kzozIotNBbYLtt6VKwWfiWNHZteuyNS7YKO5vdjU6/Jl4fZtwQ6dlel5UZuWy+3eLfiL46zysSJi5o73qLBjhxDxhSLXpG2GnSPvElTTHj8+Mna6zab8WNmcZ/Nl3WNmI6MNhfZsXfNlA7SZWT9FXrWZ1HVbdZGX/XWITep1U5m92BZlm2EqYqJiVlM7T10QZy+2vrjaiOyU2R7VimtHw15cK19trXYx1DVudtjr5j3bX1tvvVUKIyYho1xymu7z/IYZ8t8qvcfLQXKQHCQHyUFykBwkB8khhNx/koMMECQHyUFykBwkB8lBcpAcQh4QyeF2B0FykBwkB8lBcpAcJAfJIeTB/LgaIUgOkoPkIDlIDpKD5CA5hCA55CHI+fPC4sWCDdBWbNWZPhdl9u6NjFWE2bT96KNCxDpBR2QTsy1bhE5x2RZlubIhU3cI2SBrWbZMiHgtc0dj22zztG2G7a+V2q1aJfjg/mQIeo7MEDpuuVLZk3nhhchE7KuYEZmXXhI650jXeyeEuJYxYei0510RVIFeflmIWUrsVI4qWxW9rl6MjP1lwdSpgo+q9QBt2CRnNI3INozaQFmPyDaM1kZkS7b32opMgWwmrgXJ/iDV77X12gD92WcVf/ZnFX/4g/A//6dgL/7qK6F+b72oP/1Tob6Qar74Qqh3sObP/1ywXfjyS6E+sPbiPmDEJATJIUgOkoPkIDlIDpKD5CA5hJB7Jzm5YZmff9ufkRwkB8lBcpAcJAfJQXIIIdzJIUgOkoPkIDlIDpKD5CA5hCA5hCA5SA6Sg+QgOUgOkoPkEILkEGL5UtEROV5WpF5s5szIWI9ZxBvChMi8844QzylThR9+ECLWK1K3Zb+/bL3ekfWSEj9lzNOuXxdu3BDs4EQsVGTJMSYEdQB/dooS3wnTImOD+4EDQsQqQRvSTDUvXBA6+yu9bTt3RqajQKszS5ZEJuKiclCRi/DZZyNjyvfii0LERmFcZPbtE8aMEczTTJ+ee06ImJtZvjwyEWsVaWbzYdQGSnvWsAnSpsB6JjZs+rRpu6aexW2P7I+ovbjeI3vWFlW/tz44tkdNOlFvRr0ie68dK5MNE2CT2PrKsfNr1GbSdPbr023YHtXYkuttrn1JF8WIScholpw7ZZjjCZKD5CA5SA6Sg+QgOUgOIQ+d5PT4+gGXjFMhOUgOkoPkIDlIDpKD5BBCRqPk2A/1y4Z8kCA5SA6Sg+QgOUgOkoPkEEJ+M8mx1/z6n708iOQgOUgOkoPkIDlIDpKD5BBC7hvJqX9Ach6U6HhtI+O8eUKnqks60DqT6zbl3Yx5y+7dwsKFgpWPRczPWPlYxKuZzh8GGUbnzo2M+ZI1aPmUr4fO2tVWrxYiflZOKSsyixZFxlTEa750Mw4dEiLey8yeHRlrn5o/X5g+XYj4VFmkiMaY89jROHNGiNicsX68zpFckLFj9fXXgl1INjFeuSK89ZYwZ45gfYARJ5VFBa+8EpmIPwj1iFwPlCM35zk2X9qibKuaWrCa+sSaXKsfi+vHter1Np2UpkX1s94mIazXW2tMben10ajXW+9grXxIDiFIzkA/8J0cJAfJQXKQHCQHyUFykBxCyP0qOX9cMt/JQXKQHCQHyUFykBwkB8khhPBxNYLkIDlIDpKD5CA5SA6SQwj5jSRnMI1BcpAcJAfJQXKQHCQHyUFyCCH3seR0v2lDu9qDn46ZnM2sWhUZsxpvKotPlMuKTPlWP2U9V9bcFfGxYs9+nXnzzchYfdzSpZE5elQ4eFCI+D6zeXNkrHvNqskWLxZOnxZsjo8nBJO6V18VJk4UOvu7X/D6uBsZU4JPPhGsqcwm9VmzBPND6yLrXCpSL9ZpKhMDtKK227eFiNczTzwRmQULhPXrhXPnBN8j7bizw26ismFDZE6eFKziL+JHwcavpnGzaVStx82m6bOpXqypbcyetWvUqBvDmjSmyQHqXagNsI9ZfIhz1HTK7FjZgW1S69pqml5cH5ym/W0pxGPEJGQ0Sw4hSA6Sg+QgOUgOkoPkIDmEIDmEIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQQJIfck9i0ffGiEPGWsl7Rkqixkdm6VbDysYhvhV8G/YRNvd9/L8RMJQ5mduyIzNWrgr045oQQCxXb/ePKPkUn1ziR6ejTZkWG/sOHI2M9deY8Vrbm+uRZlnn22chEfJaZMSMy5jxmF3acbTPMASJ2ZbZvj0zEgRLpx+scq43K1czKlZExyYlYkzGrsSY6s6k33hAi3shs2RIZv8xaprG2wjSrk6unzyZ9atqqfprKmqbt2mr60ba6ia4+zvWKmqTOaDpl9WVWn5TaHr/5RqjN03ahqSCutscm4UdyCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ4jkzBmhM43tyLz3XmQitiovZ+z3kQ1206dH5plnBJund+4U5s0TIl4V7kRm7lwhpiuPCZs2CTZe37oVGav5mjlTiGlKfKrsyRw7Fpn9+4WIK8qSzDvvRGbXLiFirbJBeUWRFXUuBvFDq4Cz0211ap2L4aqixqsubT11Nl6a8R4/LkQsz9j5tesqYoFyTlE9fiYyZ88KL70kWNnak08KbbLRT2OYDd+ffy7Ys3VjmE2u9QBd70K9zf1Qm0nd3FXXmtV7VE/59SxuK6odoJ7jmxygqdas6Yqtz2/TObIr1v5cmWoa5R4xYhKC5BAkB8lBcpAcJAfJQXKQHELIfSM5d1KG98rel0CQHCQHyUFykBwkB8lBcggh90Jy7IfWV/a+BILkIDlIDpKD5CA5SA6SQwj53/fGcPJ/9v5g8ThBcpAcJAfJQXKQHCQHySGEjBbJqX9Ach6YnFTezFj9lJVTxROClXFFbBfULubPFyLez6xaFZl4SpgwQXCNiUvChMi8+aZw4IAQsT9jw+gnnwjmeM8/H5lLl4SIrzNHj0Ym4nLGxvqObJzNfPZZZDqj+TrlVqZTxSZtcmaeZlMRPygfZExirWov4nthdmTshBo//SQsWiRErMysXh0Za4QzxbXeNnOel1+OjF+i8W7m8ccjYwrklt40FDaN11Z7ZcVW9l57tn5vTVMlmg3uTTpRO0CtBCMoDLUQ1iLaj8Y0CUPttPWS++mpq/fINsPMxLa5/rPQ1NqnMGISguQgOUgOkoPkIDlIDpKD5CA5hJD7W3L+WCfQuw4hOUgOkoPkIDlIDpKD5CA5hBDu5BAkB8lBcpAcJAfJQXKQHEKQnHvSrtb7g7SrITlIDpKD5CA5SA6Sg+QQQkad5Ni/clM4DP9OzoOUjYoVedmIfFhQb1m4UHj6acGKrXbvFiLOZ44cicwLLwimXiZmy5ZFJmKFIn1x9it1xQrB6+NKX4qYL/ziDIm1awXb323bImOtXzduCGYX338fGVuvNcJZ29iYMZGxTrCINRkr4luyRBg/XvDramwI8YkihnBHc/16ZPbuFezasNKzmKPoHnWuje8y+/ZFxkQ0ZkXGBio3bbMpLQD0kaupqqupXa2eTevNaBqvbXKt19s05v7+94L1a/3ud4Jtla233sF+aGoqaxKGui6vpqkwrckea8Vtsjg7v3VDWr2/La7FiEnIgy05BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIQTJIaSHWL3YxInChQtCxKsZmz6tjSriM+VL5ZrwaAixTBgXQhzJ2PB97ZpgDWlmcTapRxzNWJ/YmjWCNcItXRqZ27cFq/nqtI19K/ho/oYix/nYsciYIbz6amQiliqLM2PHRsYGjE4j3CuCVu11DHCR8lFm6tTIROxS5DjbiiI+zHTO0cXMc89FxgrTbFHffhuZeE4wEfXrOfYqezLe+VbPtfUk11S2Vg+j9WzapAT1XFtvZL1V9uLappp62+qNrA9O0ylrOqF1Y1jNCPaY1X5Yr7efRdVLbromS6ljxCQEySFIDpKD5CA5SA6Sg+QgOYQQJIcgOUgOkoPkIDlIDpKD5BBCkByC5CA5SA6Sg+QgOUgOkkMIkkMIkoPkIDlIDpKD5CA5SA4hSA556LN4sWCdUXPmCD6q/jKPJkwn9u8XIlYqbyo6yMbBzMaNkbGito5NyUaaA5w+LUQszIwbFxmb45cvj0yni+yqYjrxfebSpcjYeG0VYVOmCOYt9rt75Uoh4mPFDvtJRVzLHGDaNMH8IR6PzIkTwltvCfasdb5F/Cio4nY0RkrPrl6NzLPPChHrM+aldpkdPix0jGhLxv6ywLbKrtjnnxeapjEfr+u6LZtc67m27jGz99ajeS0bTRpjYlY/a2Jav7dpm+uz0NSA1/Re2wWjSSab/KG2uPrQ1eZpDWl2XdlVZ9dkXZdXn6NSgRgxCRndknOn5G7lzp07TY8TJAfJQXKQHCQHyUFykBxCyG8jObWl/PHZEZScXz9cM+CD9VO9bxVBcpAcJAfJQXKQHCQHySGEOzn37k5O12SK/6zdBslBcpAcJAfJQXKQHCQHySHkoZacAV3CLKK4ZzLgzZYB3164x4B+0mpQSA6Sg+QgOUgOkoPkIDlIDiFIztCSM+Q9k8F+rl+A5IyenFCkucvG+oivMp0Jcl/m/PnIrFsnvPCCELFE+TpjHWgLFgid5q7vMj/+GBkzsWXLhIgVwoQQ4q3MmDGR6Qzum5SfBa3qss24fFnYt08wt7STMnlyZGKa8NNPQqfk7bLyrvDLKc7olG9LfvppIeJUxpznsccEu1QiXld2ZD75JDKdVre5me+/j4wNgeaWEfMEP+ynlM0Zm+v27BHsyhmiFerudVXVi+pnvd98IzSVvPVTL1ZvZN1EZ8/WHWh1F5ktqnYtO1Y1teTUh64+ofUu1D1m9mJTkRG0GsNOSt0mZ0vWZxkxCXmAP65WfOJrQGEY7Nkh397qJ0PeJkJykBwkB8lBcpAcJAfJQXIIQXLaJKfpK/6D3cmpP7HWpwghOUgOkoPkIDlIDpKD5CA5hCA5bZIzjBs1Tb7RiwghOUgOkoPkIDlIDpKD5CA5hCA5be1qvdyr6fM7OUO6U+8fdaNdDclBcpAcJAfJQXKQHCSHECRnmJJzt9vVhrxlxL+Tc5fzlOI9V7sFva46krNN0bH+0aiIm5mPPorMqlVCTFFsNH8pBN/Bn5QvhYkhWM2XdnNFXFNey8yfH5kbN4R4Wpg5U4jHhI6K7FW+VsR5OsIg59eq5+z8PvWUcPGiMHeuYAfWzqDZ8tq1gi3ZT3fsyuzeHZmIncpWZXXGa81UYufNE2KSoh7utYTxasYGOYv38jVJTlPPVV2ZVdea9TNA1++tW7DqF/ezGfWUX8/E5YjcVojXdBbqRdl7m56tj0bT2W86v7aDddVefXk3eRrtaoTcx5JDCJKD5CA5SA6Sg+QgOUgOIUgOIUgOkoPkIDlIDpKD5BBCkByC5CA5SA6Sg+QgOUgOkkMIQXIIkoPkIDlIDpKD5CA5SA4hBMkh9ySfCE+GEG9nFi6MTMT8zIcfRubWLcFUxHquhvIlUaCYEZmDB4VO99pCZU/mvfciY61fpiImG1YQ9/PPwtWrwvvvC9avVR/YiIuZ2ohsSLDf+52qEBGkc+ciE3Er88EHkbF2Ndv9HTuElSsF70DT4+zeMiYytkcxW4kPFLnqHn88MuZ4duiuXBHsDLovuR6vU9Yox4WmgbIe7Orhu6l8rJ5NmybXuk+saRZvqttqqkRr8rT60NXVc7XzGHWdWtMZ7Ee9apq8pa7aq7eqvhia/jpAYcQkBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCJJDCJKD5CA5SA6Sg+QgOUgOIUgOITZvqT/Y6LZmjeD1UzqqWjfX228LEV8or2e2b4+M/S6zKf/FF4WpUwVznmvXhLNnhU5zl3SRLVoUmYg3MlYgFrMU07ZxIVhfnA/uH2aWLo1MzBFMveI54ccfhfPnBWuEi1ibsQPbkdhjmUmTIlPXmtlZsENnZmLHecYMwTr97CK0S2XsWGHJEsFMbPZswQ5O59lXFZFJW1FfjWE1Tb5UG0KtBPVca4NsvVX1ZjR1r/Wji3WdWt29VptYvRn91NbVh86wrap3weoCjfpSsYvBFLemqXut3gzbI32WEZOQUS05d0p+u/zFXxY3PE6QHCQHyUFykBwkB8lBcghBckZAcoahHPVb/vjsCErO//l8zQAP1k/1vlVIDpKD5CA5SA6Sg+QgOYQQ7uTcuzs5XZMp/rN2GyQHyUFykBwkB8lBcpAcJIeQh+VOzq8/2D2QAV3CLKK4ZzLgzZYB3164x4Ab02pQSA6Sg+QgOUgOkoPkIDlIDiEPo+R0LaKWnCHvmQz2c/0CJOcepTOqLlC+VKyp7LTymnI9s3ZtZCJ2KyI58VRkNmwQIs4oS5X3M/PmRcZ7veK9jOnT+PGC/WZ/5hnh+nUhJiuaiROFnTuFxx4TrG3MWux8vNZ+vHXrBDOiCRMEL5fzTrAVwqORWb1a+PZbIV4UrEzPisusmM4uwl27ImOVd7aoiHczdtgj9irXMnbldI6GXvy/+GRGr2cb8s21hqiBaqquairUqp+tS7Hq99aTejluOvU8XQ/u9t7aPZroxw+bists6LcryWiqcasPez/tebWK2IpqL61V06hPd2lxjJiEPDx3cnr5oFctDMNY4PD8ZMjbREgOkoPkIDlIDpKD5CA5SA4hSE6b5DR9xX+wOzn1J9b6FCEkB8lBcpAcJAfJQXKQHCSHECQnRuoGTuudnKJyYMiv7iA5SA6Sg+QgOUgOkoPkIDmEIDm9Ss5gX9cZ2e/kDOlOTVtLuxqSg+QgOUgOkoPkIDlIDiFIznAk5263qw15y4h/J6evLFsmWIOWTcy/vFwx59mlfJRxB4g9yvaMFWpNmSJYRZiJ2SOPRMY63yJ+zPggq6Vnr7wiRHyV2bYtMu+8I8RjwquvCp05/uOM/bL+9FPB7MIKxCK+Uy4I0yLjNV/aCXbjRmRmzRJWrhQi1mV8B7VOzZvo4rbycsbM03043srYYGMX4eTJkYn4LHPiRGQivlVuKRsVOXRXrkRm8WLBnm3ruar9oZ8+sXrMta36/e8Fe9au4HpUrafeuiOrqU2uFrOauuXMpvy6L67Wp/rg1OeoPnRNBXG1W9bbXB/22tNqbTNsm+v9LbeZEZOQUS05hCA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQQpAccm+yVTmgSK/X/PmRMSWI2CxMj8ylS4K/9yUljmfOnIlMx5d0vXEl8/zzkbEqjLozac4c4dgx4fhxweo+Ot1cSzKffBIZaznr9MV9kdmzJzKdrrmzykHlA8VO976M1ceZtnlvWxxV3s7s3x8ZO5I22Dz5pDBtmmAbaVJn18aaNYKd/eeei0xHvE8qJjmHlDeUV4RZkfn4Y2GIubYuPavH3JqmEbl+tlaRJjGrZcNeXB8Ne9bWa2ZS95jVfWJG/V5bUVNTWX3Ym4y36VLpx5abLK6p8c+ww95yQhkxCUFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQx76WEfW3r3Cjh1CZ9y0sjUZoG/ejMyYMULEXMF9SSZXlysdGSO+znQq0aR9a/z4yHSqyWxylSo2axuL55W4ruiYq0OwVcDdvi2YeU6cGJlFiwQrEIs4kfFDpwVxH3wQGS/T02I6e/HmzUKMEcaNEzouvTzz7ruReeEF4b33BGuii9id2bkzMhcvCjFWsH68Tlug2NT69ZGJiUrsV7YpNzKvvx4ZH+ya+rVqrH6qaQhuMpOmSb1pnq6frfu16h6zpvHanq2X3LTemn7co362FtF6vfWimnawvtrrUrsmTysr4BgxCRnNknPnTgUhSA6Sg+QgOUgOkoPkIDmEIDkjk18/FTLgg/VT+RH7gSA5SA6Sg+QgOUgOkoPkEILkjCLJKf6zdhskB8lBcpAcJAfJQXKQHCSHECSnV8n51R8GvLsy4F2X4vUDCsxgJlPID3dykBwkB8lBcpAcJAfJQXIIQXL6kpzB7qIM+XOrnyA5oywqDKYxFy4INvVGfJsZOzYy8ZxgNmWzqbWrdQrEXlakbcx+l/l7ZyvavWYKZIZgR6NjRCsUq0RbIEwJIS4q0oFmU741lUW8mnn22chEbMls2hQZP4OThC1bhHhWUYm12rqYo8T5zJUrkek4zxJF+9NcgA9ntm+PTMSbisQObOc4L84cPRqZH34Q7AKeMiUyV68KdnnbXyW0FZf1Uz9VT4F1RZjx7beCNVnVktNPu1p9NOrdt62qh+B+SsCMfmSjSQlqBSqn/CF2oanTrxaVpnNUX0hNZWt2xeqzjJiEPPB3cob0iiEf79FPirtDSA6Sg+QgOUgOkoPkIDlIDiFIziiSnKwufYoQkoPkIDlIDpKD5CA5SA6SQwiSM7ru5NzpBMlBcpAcJAfJQXKQHCQHySGE/PaSM9jPvUhOqyDRrobkIDlIDpKD5CA5SA6SQwiSc3clp8fvzwz4z93U92T4d3JGS6zXy+6+LV4cmYifM1bz1WnB+oPgQ/CezIkTkbGRMWKTokvWWXzXLuHHH4VOB5r5w/eZ69cjY0JoNjVpkhATlLgs6OA+a5YQcUS5lPEB2mu+rNdLhNAb4dQAreXMFTfWZNati4zLxh1h3z6hk1uKlNrFY5FZuFCw6jnTtpgqfPSRYLsQcUDZkbHryk1MT9natZGxPzgRJwWb5OoJsq4XO3VKsGfrMdewrWoyk6baq3qstyXXU289qTdZXD9Dv+1RXT5Wq0jT7jfZsm1VPwrUjxHZs7XyNV0qtQLpixkxCRnNkkMIkoPkIDlIDpKD5CA5SA4hSA4hSA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiEEySH3Ji8IZ84IEeszNrq9847QKRBTFRkbGRMkG2S9ey1WZ27dikzEK4La1PTpwpIlgkuOtmCZA3z/vXD8uOCTq0md2UXMFezQaTHd6dNCxA3hmchs3CjEk4L1em3eLER8lOn0tkmtmXXNPfGE8NNPQsRx5TVFrObAgSiIJ5TYqJhOqFuqpto5GjdOcGuNzwR3S6np61xmcsqmTo3MECNyXQJWj6r1PF27Rz1e27NN6+3HiOo+sSabquvUDLPH3/1OsGftpDS5Rz3WN/lh7Uv10einxK+fxr/aW5rOoJ2U8hwxYhKC5BAkB8lBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcJIcQJIc89HnssYqI5ZktWyJj5VSrVwudcfOrzDPPRCbi5czOnZGZNk3o1LjZxCzrNSMyUbGSt07N15KM9Wt16rYOZSZPjozV1nWGYBmRX389MnY0PvtMuHxZOHJEuHJFiNiizMtcuhSZTsnblczPP0fG5rrO2T+tqBDasypmVj23dKnw8ceC+XBn9+UitONsp+yNN4R58wQzIqvmsr8sOH9e8LZA60CrR9W6Tq1WoHq8bhKGpmm7frbejLrIq0nbbLyum8rqwb2pEK8e3JuoD3stk7ZHdsl+841gz9YHp+lY1aV2hr23PmX23pYrlhGTECSnn/zuL9L/QurHh1zFiGwGkoPkIDlIDpKD5CA5SA4h5F5Izu86GZ4w3D3JGUGZGbbk3PsdR3KQHCQHyUFykBwkB8khhAxfcu6eddxjybl7d3KQHCQHyUFykBwkB8lBcpAcQu57yfn1cbu9073hk1822Gu694sGXHV3S7ovyEsYcC31GnvZkuKmFp6D5CA5SA6Sg+QgOUgOkkPI/S05A/rDgOIx4H8O+fMwJKf+ufdVd3+uX4DkdDJTsIGyk6XCuBDigrIvY+1bNl5HrBAeDSEWZ2zKjziQsSnfGuEiVmZWrIiMt28p27YJEW8o2iantXUxRtGuOfPDc+eEl14SzMQWL45MxIeK2OP8+ZEx1zp4ULD5edMm4epVYf9+wXx4xw5h5kzhrbeEzkV4TpgWgvbUmTy/9poQTwud2rp1GVPriG2KtrrppWLNbJ98IsQdpR5Gm+bafmSj7qpqko2mOjWbXGtD6Gd/TflqA2zqXqs9rV5yk2rWnlY7QJM+1f7QtKj6xfUeNS2qXnLZB8iISch9+p2cweb7eu5vfVf9gbF+JGdENgPJQXKQHCQHyUFykBwkB8kh5EH7uNpDKDlFDQOSg+QgOUgOkoPkIDlIDpJDCJLzux51ZXTeyeE7OUgOkoPkIDlIDpKD5CA5hCA5bV+GGfKfoBlSbO7ed3KKNRIkB8lBcpAcJAfJQXIIIQ/Ud3KKlzW1q/XiD8OTnLvRrobkSPbuFSIOKmIXEydGZvt2wQb32bMFK8VyX4rDimzGU09FxtrVrAXLh+Apgv2yjmcVFTP7LWl1ap1ZfIPymXIjc+1aZGwW75RxvZmZMSMynUo0be76RYoyWj7WMaIPMp9+GhmLdb5F/KhcUS5nTK7sOHdk8t1Mx5Z/yIwfH5n33xfsLET8lLH+tJUrhV/2OGMb+eabglXP2R+cw4eFIUbzptGtaSisX9xPnVqTXNXO0zTH135Y06Rt/WhMvaim81vvbz8OYNSnrN6j+sA2FdM1GX7LnyNGTEJGueSMhn/uppac0WAXo2QzkBwkB8lBcpAcJAfJQXIIIfeB5CAPSA6Sg+QgOUgOkoPkIDmEkAdEcrg9guQgOUgOkoPkIDlIDpJDCLlfJYcgOUgOkoPkIDlIDpKD5BBCkBwymvO4MlXYvFmI2J5ZtCgyW7cKEWcFVaCYLvg8/YRw4IBgknP7thDxScZKwD78UIg5SlxTdmfWrYvMiRPC9OlCZ6teVm4qxzM2Xtsv+ps3hYgvlGWCtrpZm5wdHNtBK1uL2KHI0D95cmQiLiq3FDNA3eZ4S9kqzIiMt+d595pehNaAZ5V3cVXRi8F8+BllomI7+HxkrABwJO2ibgwrC6acelH1WN+PAtUTcz99Yk1G1M97m3bQjnMtSJ9/LtTHqkk2mi6z+mjUgjSCVjNyXXOMmIQgOQTJQXKQHCQHyUFykBwkhxBy7yQn1yXz82/7M5KD5CA5SA6Sg+QgOUgOIYQ7OQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXKQHEKQHEIk1oEW8Z4is/iFC5GxidmGfpvyjx4VrDFs0qTIHDokdMZ6UYK5cyPTaf3ar7ymyDy9cWNkIk4o0vl2+nRkli0TIq4Lj0TmzBnBhMHmaTsaMVvR+riI9zOdFcngfvlyZLynLt7I7NkTGXMer9qLrzI2uphL29BvlWgmwN9+K1iN25gxkXn7bcHq1DoVcMsFNZOTJwUrHoxYk3n11cj4xTA+hKYSsHoYbbKLulCracpvmnrrjWyqJqt3sB/ZqN2j6cX96IQt2d5bb0Y/5XKGtVI2OV7TwemnXK7pAtZFMWISMqol50/+pOIe5s5f5L4e+x+AXUBykBwkB8lBcpAcJAfJIQTJ+f8n+3q+7/E190BCBvzPwR7vfxVIDpKD5CA5SA6Sg+QgOYSQ+1Jy6vk+P154zr2XnLuxaiQHyUFykBwkB8lBcpAcQsj9LTnDuAcy4GsGXE42ogHvBd3R1PeOBnykeLxeb37qIfUcJAfJQXKQHCQHyUFyCCFITpPkDHb/p8+fmz6u1ssyR/bTbvdTnn1WsLqtxYsFG/uuXROmThWGmhFfUX5Q1mWuX4/MCy8IER8pOqrGd8qryl7h0RC0As56zF5/PTLz5glW8hYxVzmTsfo4m/LPnxc6u3BI0Navl14SHnlEsD6x77+PzPLlwowZwpYtgsmVHfZZsyLTEcJPFZHYU6ciM4SXWumZnlA7Gps2CatWCZ0KONlBOxom/BcvCjFL+OQTYYjps58ir3ror4vLmrylHkb7Ua+m7rX62fpYtczEffWYNe1v0w42nSM73fVG1s/2o+W184zg0Si3ihGTECSn9QNjPf7naHscyUFykBwkB8lBcpAcJIcQ8nBJTu+tA8Vnz3q8M9P6eiQHyUFykBwkB8lBcpAcJIcQJKdtvm/ynx4X26OE3LM7QkgOkoPkIDlIDpKD5CA5hJD7XnIGG/37/K7OkF/RGd53ZkbwOzk9bjmSg+QgOUgOkoPkIDlIDiHkvpScwfrH6g+P9S45I9Ku1u1D6368rald7WGXnKeeEp54Qohxis6XCxZE5r33hIhdynpFettcJ55U4rTyfebYschEbBG0i6xT8rY5Y7O4+4Mejd27hYiTBVbFZo43dmxkYoYSl5R3M+al5kvWbHT2rLBmjbBypRBxIdNxANVUtQvztIhVmY8+isy4cYL1tnV08cuM7YLXuOlVt3p1ZKwDrbPNHysblM3K+cwrr0SmI3UHhFon+mlXq4fvekX9TL1NQ3A9i9czcVN/Wr1V/QzuTSVvtgtNK6pF1J6tzbPeqqYLqcnTmhZVi1ktdS36xIhJyKiWnFGT+p8KvS/+UZph7AKSg+QgOUgOkoPkIDlIDiHkgZWc4UlFECQHyUFykBwkB8lBcpAcQpAcJIcgOUgOkoPkIDlIDpKD5BCC5BCC5CA5SA6Sg+QgOUgOkkMIkkMe6BxRbJ7emLEqNpt6p00TIi5mOoPsZeVo5tNPIxNxSnk58/zzkXnjDeHgQWHnTsFM7MaNyNjv0IilmRdfjIwp3w8/CM89J8RUYfZsIeJKxnbw3XcFOxreNqb1cYsWRebnn4UlS4SO8m1U9isidXY0Jk0SbI/sQpoyRYh4TflKkTN482ZkbI8irinWn2Zqukx5I+N/HRA/Z0yfLl0SrJawbb60i7Ke8puMqN6M2i5MpusCMduFr78W6sm1aa5taldrEiRbUb37TVN+Pwenn4K4pvX247RNrX31ij7/XKgv4HIjGTEJQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDHvo8/rjQGZHFLg4disyJE8LWrcKMGUJnJjbJse41aUizBq29e4WI9zNnzkTGxs0NGwSzmojrmS1bIvPkk8L+/UKnjMtm8eWZmTMjE+OFTZuEHTuEU6eE6dMFG+vXrxdijmDHaupUwdzDzm+8qMTBzMKFkbEjGU8LHavZJ/ziVwlrZnv7beHWLcFWFLFAmByCnn07KSbeVoh34YIQM5Xyz5F3RtXzZdOMWGMrapqYm1qwmgrEam9p6jFr0pjaW+xZo+nA1pVoTTtoG9lkF/Vhr/W46VKp9amfS6WpWrC8gBkxCRnVkvPOOxX3MHf+IiOynHuzIiQHyUFykBwkB8lBcpAcQsiDKTl3UoZ8QWEXIyUevSwHyUFykBwkB8lBcpAcJAfJIQTJGVoYCskZKTlBcpAcJAfJQXKQHCQHyUFyCCF3V3LMFgaUh+FZx4B3fga7IzTYzaLiDhKeg+QgOUgOkoPkIDlIDpJDCJIzfMnp5SNtg31tJv8wIj8jOSMT+6U5f75gs5o1SllhmrWNRazKWO2VMWGCYNPn++8LnXox86VPlJvK4ozvb2zOdP4cSd3Wvn2RidiTuX49Mh3HW5jptMktypguTp4sWCGeHaurV4WIExnzlnnzhDlzhJUrhVdeEcxqrC/Ox/rnlelK7FZuZX78MTLW+GfibSe0UwB4RvlZEW3zfrxnBbuAOx5uRW1/EJqGwiYzaZoR66HQhtFvvhHqjbT3GrUh1KN5k8b0U6dWF4jVmtpPQ1qtfE29fEbdRNfkD/WhqwWpH4e3Z5s2UpvZGDEJecglp5cv/Q/jjtBgH5Mb8nEkB8lBcpAcJAfJQXKQHCSHECRnxCSnVWD6lJziJhKSg+QgOUgOkoPkIDlIDpJDCJJz/0kO3QNIDpKD5CA5SA6Sg+QgOYQgOSPTrlb83MvXckb8OznFJhEkB8lBcpAcJAfJQXKQHEKQnBiy8azHVrQhuwfuUrsakjMi2ZY5dy4y3nOlY5/Xbb0k+Fz7jBIrMtYSFHE+c/RoZCLWZqz0LOI75YCg9WLffSfEVGHBAsEc7/RpYeJEIeK4IpP6Sy9FxqbtI0ciE3EsY61upnzWrhbxsjA7Mtau5oV40xTrIpukWDXZE5GxEr/33hMiPsrYce4Iw+HMa69Fxi7CjvFazik/CGr4XogXn2Vefjky164JEa9ntm+PjHdk2YxY14vVhtCPezRh42ZtCLZHVheo0+cQ763n+H72yCyuFrN+DKGp5cyo1as2hH42sp/Ssyapq6/2utOv7m3TC4kRk5BRLTmjJrUC3Y8rQnKQHCQHyUFykBwkB8khhDzUkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcJIcQJIcQj7VgRVzIrFsXmc5sKnPt4sWRifhWsfyUWbo0Mu4tjypxSlkujAlBi7w++kiIcUpcVL5Stiv6YrW4HTuEiPmZ9esjE08J5h4bNggRbwvWVDZFiSsZk6vjxwWb1K3kzTXml/OSsFa3SZMEa3X74IPIWHHZ8uWCKVDEjYwrkJ6FWbMEUyC/GFzpNwmuTyJInUMn77WDE7FDqEfVulHKvKWePpvaqOqBsl5ULTlNjWFmgE1KUI/19TzdT59YP/VidXteXT5Wm2ftaU0W14/UNflh0/VcG2DZRMeISQiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXKQHEKQHEK0bSzisrJeka6qt9+OzIsvCjYTX7oUGZtNL1wQbESeN08w9Yr4UlmVmTw5MiYqly9HxnrM7mhsJn7kEaEz5pqJva8sVvYLelLGjBGsuOz2bSHiY2F6ZEyfzIguXhSsEc7q1DptciKEzzwTmYirgpa8TZggPPWUEPGaoA14c+YItr925Vh/2tixkbEyPWsanD9fMDEbN06I2KWILnpRWzl+DTGr1Q1aTaNq03trM2kyhNqX6qNhCtS0GU3CMIJK0I8w2P5aE509W7f21ebZVOJXH42mS7TpwNbvtX68Uq0ZMQkZ1ZJTdyfew/w6DY7sAvt/74hvFZKD5CA5SA6Sg+QgOUgOIWS0S06e5fp8zYhb04i8F8lBcpAcJAfJQXKQHCQHySHkoZOcWgbs8R5fhuQgOUgOkoPkIDlIDpKD5BBCfgPJ6UVghveawW7+DPn4kKLSy5J7FDMkB8lBcpAcJAfJQXKQHEIIktMgOQP+POQ3Z4of6iUX38NBcgbK08pMJRZkbt2KjD1rzhOxJ/PZZ5Gxbq533hGmTBHMiM6eFT7+WPj+e2HGDME8zcb6rVuFxx8XbOgfPz4yrjG/XGyJTz8VIi4Jj0TG5Mq65sx5bPefflqIuCbMisz+/YK3yf1yuDIqGy+8EBk7ZREfZrZvj8wPPwjmh6a4V68KEe9mDhyIzMaNQjynxN7M4cORifgsc+1aZCLmCfonxVSzs80rMydORKZtVD15Uqidp8mXamFo6siqjajewSbls2ftvfVY31SJVm9zvQtN6mUXQ9PRaOkTa5OrJupSu6b+tPqENkldeUIZMQl5yCWnl+/k1MsZ8l2FOPW45OFtAJKD5CA5SA6Sg+QgOUgOIYQ7OcN5zWAfNhtScrqP3+kEyUFykBwkB8lBcpAcJAfJIQTJ+c0kp8fHe7+T0+etJCQHyUFykBwkB8lBcpAcQsiDJjnFV1/6aVfr5Ts5Q75myHcV3+qhXQ3JQXKQHCQHyUFykBwkh5CHWnLqZrNh/Ds5vbSrDfaWEW9XQ3IGy4nM+vWRiVimHM6Y1ezcKXRGZOkTs1HNW90mhBD7MlZ7ZVOvGZHVbdmKfBgdW6LdXFbGFXEz03lWBujnn4+MOZ55WsROxSrvNmSOHYtMxJuZl16KTMTczPLlkYlYkzFRWbpUOHVKsLPwxBNCxEJB++LMD524kDEvXbtWsGN19Ghk3n1XMAH23jYzwPiDYmV6txV5sber1U1WdetXUzVZPV/ajNjPMNokV/Ug2zRPNxV5Nc3i9Yvr3rb6lBm1TNYvrreqyUubHK/JHuv1Nnl4LYT1onS9jJiEjGrJGTUZ8js2v/lWESQHyUFykBwkB8lBcpAcQpCc4asFCoHkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYTEm28K3kZl3WvarxW/TH6Z+EmRsc/G3DNnhMWLBatEmzZNuH5deO01YfduYfNmYdUqIeKGYhEHsCKvmCrcuCF0huCTikqdP/udIkdy9uzIRBzI7NsXGXOAbdsE2+YdO4QYr8R7wsQQYnfGTorVx0Vsz9y8GZmIQxk7+3PnCnYhRRzMfPttZMaOFZ56SrBnV68WYowSmzM2UO3aJXj1nB3YWgnq6bOpIqxeVF1f8/XXQv1sk2zUDWn1PF0P7k2OVzd3NTXR1SrSZBdNqllbTdPuN105tePV56jp2mg6Ry2XNyMmIUgOQXKQHCQHyUFykBwkB8khhCA5BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQpAcQpAcJAfJQXKQHCQHyUFyCEFyyEMfG+xeeUVYt07oDJSXhCcjc+mSELEjY9OnFYgdPhyZCROETt2WVcBtzBw5EpmYrTwmWMtZxC5FesymT4/M5MmC9afFo4rXxx3NXLwYGRMG60+zxjBzjyVLBFMRc56Ij5TrmY6K7FUWKOeVTRmbgiJ+zJiXmrbZSTExu3ZN+OEHwfTYdv/yZeHCBeGtt4SIr5XlmU5P3THlotBPo1RNPTHbkq0gr54g64GyaSaup+2mgzOCk3qTTNpW2ZGsF1U/a0N/LaJNOlEvyv6ImsTW1EeyvnLs2fp6bnpxCSMmIUjOqM3v/iLDfu/dXgWSg+QgOUgOkoPkIDlIDiFkOJLzO81gjw82qQ/23hH0kLsqOcNeb3FA7uUuIDlIDpKD5CA5SA6Sg+QQguQMMZT/8T97Gc37ee8ol5xhvxfJQXKQHCQHyUFykBwkhxDy4EjOYPd2fv3hj48Mtsb83npRg21t/d5ednzAjRzwjlZ+/ZArfQA9B8lBcpAcJAfJQXKQHELIwyM5Ay6z+DCbGUK9Gb28d0DbGfZGDrao4vX3+H7Ub5MFC4TvvxfOnRNu3xYirirSN3X6dGRsURFvKS9n9uyJjLW6WSlWxP6MycaWLULEJxkbZCPWZT7+ODIRSzOvvhoZaypzudJCLauAi1iR6eygzsTxbsaH72eUF5U4rnyq7FfOZqyIzzXVzVOO8/vvR8b609aujczOnYKJil1X1nH33nvCo48KtlURX2Q2bIiM1dZZq5tdG2a8Jvxmj/6XBTZy1X1Thg2jtih7tol6VK3Vy57tp0Grnrab9qie42vXsnm6qdSuyZfq82sHth8Rrak3o+5Ps3PUdD3XNB32louBEZMQvpPTu6j07mDDc6ERXHI/e4HkIDlIDpKD5CA5SA6SQwi5d3dy+pnLh6ccd0lyhjQ0JAfJQXKQHCQHyUFykBwkhxAk536SnGF/Tg/JQXKQHCQHyUFykBwkB8kh5OGVnP4/PFZ846X1vb1/C2iwpfXyTaFhSM6D2a6G5CA5SA6Sg+QgOUgOIeR+lJx+vpNT+IC9oHjjkI/0sooe/zGcXjrfepScu/evBo2qSLGVjZuPPSZYN1fEhcxPP0UmZirxrXIjM21aZMyINm0SIg4LUyJjzUZXrwo2jN66JUQsFHRwt1+pEYuFGZHpFIhtzzz9dGRsKvj0U8H2yJTPxvqpUwVbssmkzUg+qeuKDh2KTMStzOLFkYlJirar2SnrqNeZzIoVkTl7Vpg0SThxQojYJjwegmp5pzxQdr/jLR9k5s+PTMQqxf46QLoEhyjFqsfrepBtahtrmvKbBuj6vSZIdSdYvc1NL66L2uodrF9sK6qVYATlqqk+zt5re9SPp9UnpR+NqZfc9GLa1Qi5ryTnYU6tQCPyKb5hrALJQXKQHCQHyUFykBwkhxCC5Nx1F3rgjQXJQXKQHCQHyUFykBwkhxAk52G854PhIDlIDpKD5CA5SA6Sg+QQguQQJAfJQXKQHCQHyUFykBxCCJJD7oe8nbEmqxgjbNsmXLokHD8ufPCBcOCA0Clq+0KRGXHz5siYL+3bFxn7ZX39uvD884L1mI0bJ0QcFay4LG4qGzNvvBEZn/JfiszChUI8pfh6P87s3x+ZiK8zpkA+Xk8IIa4Is0KILcp6ZV/mjqazkUsy9uKYE5kdO4S33xbsLLz8cmRWrRIirmdmzYpMxKnM5cuRsWvD2vNsRYcPCxHzMydPRmaIWa0WBjPgpuG7nsXr8rG6Ia3e5qaOrCaLaxqR6/21vx6o+eYbwZoH7cW2C+Z4dctZk7b1s6h6B+ueuiaLsyu27pprUtz6mtRtZsQkBMkhSA6Sg+QgOUgOkoPkIDmEkHsnOdbIzM+/4c9IDpKD5CA5SA6Sg+QgOYQQ7uQQJAfJQXKQHCQHyUFykBxCkBxCkBwkB8lBcpAcJAfJQXIIQXIIkYwdK9gQ3GlX25DZuTMy5ksR5zOdirBXhEcis3q1MGGCYOO1beT33wvxvOAlYDrXxrTImKeZbFy5InR6zN7MvPNOZDp1W9eUrzIzZkTGJvVHHomMKZCVrcUTwocfCtY2FrErY+155pZ2bZghRJzOXLsWmYkTBROz3buFrVsF28hOq5vW5WmnX6cuTy/gySHEgsycOZGJOKB8qMhmzJ4dGZ8R6zm+biqr+7XqYbQe+pte3FR61lQB19T6NYJHo+4Ea+qaq3ewvhhqE2sqLms6zv34cG1iTRJbX1f1KSsXxYhJyGiWnN+VYZL/Y/6/vyYmSA6Sg+QgOUgOkoPkIDmEPPCSM+Donx+Uz5IM9OBgSxjwqfpdA27PSMkJkoPkIDlIDpKD5CA5SA6SQ8jDIjk2/edHuk/Vjw/oSL28DMlBcpAcJAfJQXKQHCQHySEEyfkNJKcXFWl6qlVyBrsR1MvjvdyeGvCAIDlIDpKD5CA5SA6Sg+QQQu6/j6uZh4xOyTH76uV207B/fkiihVrakWU1UOYeNqn7lK8FYt5UputdsSIyMV5YtkywUdX6ta5ejUzMFqwUq9OB9m7m008j8+67wt69greNqbZ5oVasVk6V7MmcPx+ZiNeVk8r2zNGjkbEdND802bh1SzCLs0q0iGPKCuWSIifU9MkU15wn7iiq1p2tEpm03TfhnzZNeO01IR5T9IR+911k1qwRDh4UfM6zuq2mArG6Xa0eKJvGzbowrZ/NqOfp2pfqKb+maUSuO8H6aYSrDaGpMK0+sE2lZ7ZHTee3n+uq3si6iq2ugNNnGTEJeWglp77p0So5PX4np5veP+3Wy2fqenwcyUFykBwkB8lBcpAcJIcQch9LTuun1IYtOf18J2cw+RnsY2n1HZ4hX4/kIDlIDpKD5CA5SA6SQwhBcu665PSynGHfsUFykBwkB8lBcpAcJAfJIYQ8UJIzIp/4uqvtaoN9ZK57S6fpuzfcyUFykBwkB8lBcpAcJIcQ8hBJzmj7d3KGbFErXj+MLxo94PEWrBnC3LlCx4jELlxUNI8/LkQczLzySmTGjBHicWHlSmHTJuHECSHirPKq8MvCE9Y2ZvO0l2LFvIxVsS1dKpjzTJ8u2A6++KIQcTizbl1kjh8XIpYpPyoXMuZpTz0lRBzK1Cfl5k0h4rOMNbPZ0bCR6fXXBT+haq0Rt4SnI2PvnTlTMPeIqYo1pL0QglrNuXORsR00ER0/PjI+nNkU2DRQNk3b9XvrEbkWBpsv7e8/mtq3mvq1am+xrbJF1cfZNqMfEW3SxRF8cdMONq3ILhU7OLUQ1s5TH+emsjUkh5D7VnIIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDnknqQzT29S1masbiumKSoMVtVlE6RN6iY5P/wgeLHVM4rKxvXrkdmwQbC6rStXhGeeEWxRZoC2+1OmCJ0Dez2zbVtkIpZnbPcnTRKeflowJZg4UYhYqazJzJsXGZsZOvVxVuP2kaAH1izOBgxTkTNnhIgDGbO4jz8W7Az6JaqXilmNy4ZLzs7MxYuRMfM8ezYyNtdFfKGoPjU1hjV1VdWiYs82WY15S1PNV5OJ1WVrtcbYRn77rWDP1kuu6Udymkre7NnaHmt5rg9svahaNuoKuKbaulr4a306dUootY0RkxAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYTEfEWmbesx86ayJyJjhhCxULAJUru5xo0TvFDrKSXWZ6zYyhrhpk4VbBaPsYppzGNKHFFeUy5n5syJTIxX4pjyvSINaeZLTzwhLF8urFolxDjFzEQbw0wIFy0SYoJgXXMHDggnTwrxnBLHM0uWRKYjGx9nbPetXW3r1shEvJ0xtTYFMre099olOmuWYLGavog9Gb826mG0rlOzSe73vxfsNNT9WrWK1KN5k03V47UN7jW1e9TrrWnao1pFmkrAaiWo3bK21vrs97P79ZXTdOiaCgDr99birYedEZOQ0Sw575S5X6btO3fusBlIDpKD5CA5SA6Sg+QgOYQgOSMmOXf+T3p5/I6meLCXdw3DLgbcTiQHyUFykBwkB8lBcpAcJIcQJGeAyb715971oH4BkoPkIDlIDpKD5CA5SA6SQwiSMzKSM9hYX4jECErOgMus7wgNKTmDvb2Xx4dczq8/F9uG5CA5SA6Sg+QgOUgOkkMIQXL8hwF/7n3bBvu59fVNm3R/ppzzOiVg72fsN87Bg0LEdxkbvq9eFSJWK9uUBYpO6tpzNWFCZKzkbf16IWJVxtrGrAXLar6ee04wydmzJzJWaxa/XD+JZ58VrHws4oLyhiLKZ8Kwdq0QcTFz5EhkrBLtjTeETrvafuGlEOJnZa0i14YdWLuuIn5QzikfZMy1PvpIMHs8fDgyW7YI5lq3bwvW6tbZ3z3KQUUv76bhu6m5q2kWt4Hy888r6umz3uZ66G+a8q0w7ZtvKqx7rW5mM/oRpFpTmwywnyq2epv7Oft1y1lTm5yd36aD03S167OMmIQgOV0xuEvfyRnMRopF9SIzPQpb6+NIDpKD5CA5SA6Sg+QgOYQQ7uT0dCdnSF/qUcAG+/hZj3d4hnw9koPkIDlIDpKD5CA5SA4hBMkZWnL6KR7ocXeGfccGyUFykBwkB8lBcpAcJIcQMtol57dtV6u/k9P7uoZ8e/eWTtN3b7iTg+QgOUgOkoPkIDlIDiHkfpKcYfw7Ofd1u1rx+h7b1R6QmANE7M6cOROZ118XrE5t6VLhp5+EmTMFM6LOyLgxY6fHC9MmChOViJczFy5EZvJkoTNPfyaoED72mGADdMR5QXvb3nxTiNiVOX06MmaAdjQ6uzAv89JLkYnYK+geeblc3M545Z3Wmm3fHhm7csaMEc6fF0yfpk2LjF0q3ttme6RmMn684I1/sShjvXz2rF1IdgbXrBFM22y+8q65fiSnni+bWrD6eXHdctY019b9aXVlVpN7NC2qVq8mxzN96qderH5xfUKbbKppyfUlaouqTaxecpMel5coIyYho1lyCEFykBwkB8lBcpAcJAfJIQTJIQTJQXKQHCQHyUFykBxCCJJDkBwkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA55J7k2DHBpu2I45mVKyPz6qtCxFnlPWWlMCYymzYJEVsVKeOyRiWbtj/9NDI//ijYe00YvvsuMpcuCaZenR2cm/FerwlK/KRoN5fLhhyN/fsj02mik6456wRzJXgyMra/Z88Ks2cL1mL31lvCZ58JCxcKMV3RFjsrPYtYkbl4MTIROwW9rp5+WjATs222AsAYp+gfjY0bI2Nn36rndu2KjPcQ2lhfD9/12NekQPV4XQ/BTU1ldZFXvQtNytdkJrWY9UNdp1afFOsxG8EyPXtxUz/e3TuwTY1wtVw1SZ1eooyYhCA5BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCEFyCEFykBwkB8lBcpAcJAfJIQTJIWSWEkcy69ZFZvNmIaYI1qDVUYILGete6+jE0UynjOtkZu3ayHzwgfDEE0LEK8pXmQ0bImP9aY88Irz2mnD9uhDxhqJFbbqDvpFWehY7MqZPVmpnA3PEp5n58yNjFWGHDgnxtGBDQswUOpoqSmAbefOm0FE+s8fLmSefjEzEPmVBxq6Nxx8X7Lr6+WchpgkffiiY4T/7rBBxMOPtanFGqA3Bzug33whm7XU1WZMg1RpTr6geZOv12vBtQ3+TA9TlY03US67t0f7k9OO05aQ+hDA0FcTVJ6WpAq4+g8YIannLkWTEJGQ0S86dP6u4H3Pnzp0HeHVIDpKD5CA5SA6Sg+QgOYSQeyE5f/zMzjCsYMQlYcAFdh8cqfUiOUgOkoPkIDlIDpKD5BBCHjTJyVN+LxP/3bYCJAfJQXKQHCQHyUFykBwkhxAkZ/iSU8iDfTG7++CAjtS9KfTrzwPeLCpe3yQ5Ay6nx8ebth/JQXKQHCQHyUFykBwkhxBy30vOgD+3vn5AhymW85tvZ7H9D1AmCjduCDaL29jX0cTXlbcyjz4amZisxAfKduWgInn/feH554V4VJgyRVi2TIjYrOgeTQrhKSUuZQ4ciExnjj+VuXUrMt5Fpn5os/i1a0LEu8qSjM1X48cLEV9mzBDMLc+ciYxVsZlMvvJKZGzJzzwjdPTYNGa3skT5gyJXjlWimZdu2SLYYX/uucjMnCl0TvdpRbvX1A+HGEbrYqvaPezFtbfUU2/T8N30bJOK1LO4TcynTgn1PF2v1zayLgFr0ol66G/ahSblq/2hn3K5en9///uKen/rHawVqDzsjJiEPLSSc1cf73G9A9576UVm7tJ+ITlIDpKD5CA5SA6Sg+QQQpCcO718zKzPOzlDfvysxzs8PW4PkoPkIDlIDpKD5CA5SA4hBMm5ix9Xa2qBa71jg+QgOUgOkoPkIDlIDpJDCLmfJKdoVxvB77oMKRX938lpWn4/3x1CcpAcJAfJQXKQHCQHySGEjHbJ6aX6bMDPgDW1q9UfV+vnTk4vLWq9fEyuqe3tQcjhw0LHLozbyreKlGItXhwZ69fasUOI8YK9OOLjzJw5kbG6LauAs0o0G0atii1iuXJCkWet18p6zCKuKZcVmdQ747XMxKYis2YJHUNYJ8yJzIULgnWRHTkSGdOn9euFiG0Zn/InKGq8585FJsYJVnpm53fXLuHyZWH3bsFsytoCO5e3OO3Vq5GxYrqTJ4WItYq0FE6fHhlv3qvH3HrKrxulmobv2ogMK3mra75sM5omZltyk/I1qUhtgPUu2KLslNU2VatIvd76xbbe2ohqJag1tS7E62cz6uu5ybXKQ8eIScholpx7/O/VECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIQTJIQTJQXKQHCQHyUFykBwkhxAkhzys2bRJmDpVMFGx5puIQ4oViH0vTI2M/aZ75x1h8mTBhuC33hJsnt6wQTh0SIhYqhzL2JT/1FOC+cPBg5GxnrolS4QJE4SIxZmxYyMTcUBZlDFtM9noNLOJl1rHnR0cmze2bxciVmeOHYtMxFcZO78vvyy8+abQ8cM9yo+KGK+153UWJeJtChTxtmIVf3sz9tcB5kuPPSacPi3Ye+1qH6K5q1YRG/vq8bqpX6uJehitta3eyHrqtSXXVV31cW7yB9t9K7UzAzTsb0fq99YvNjGzba7lyg5OrV5111z94vrZesm1INXUm6FnkBGTECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIUgOIUgOkoPkIDlIDpKD5CA5hCA55KGPz1teAqYDZbybsWoyM4RVqwT7FRMxP/PDD5GJlwQbzV94QYhYL6hsLFsmzJ4teM9V7FTOKSszNsjae00XY7qikjNjRmQ6oiLrPXs2MvGkYH1iEZcyV65ExprZzD1u3hQ++UTwY/XLwcyol27cKJgAT5kSmZgpHD0qdNrkvsxY95pruV5XMUmJUxm7gCNWKSczCxZEppPPlC8Em2ubysdq2bBn69m0LtSqHcCo++IMW2+Te9TdXLb7tXs0iYq9uDbAfk5o3XFXK25diVY/W/en1ZpaX1dGU9lavQv1isorhxGTkNEsOXeOHCl4SMb1wf5JH/6pHyQHyUFykBwkB8lBcpAcQh5GybmTMiKO0b9a3BkoSA6Sg+QgOUgOkoPkIDlIDiFIzpF74yd3zyV6XDKSg+QgOUgOkoPkIDlIDpJDCJIztAYMdhfFHuy+LL9+wIX8+vPwbtEMtsBiRSN1wwrJQXKQHCQHyUFykBwkhxByH0tOV2MG/Lm+HdTLQoYUrV7+s5ctHGztD3Okfmr69MisXi1YhZQVpn33nWCT66xZgvmSzQxvvCFEvJ6ZOTMyNm1PnBgZayfqaNvyzKJFkbHfoTduCBEbMs89F5mOiR1WbivqWs9GZs8eIWJFZt68yHTUa27m6tXIdOrFlikiSKaaEZuUK8JTkbEmunHjhIjryg5FWt327YvMe+8JS5cKbmJjItOpj5PLzM6CXd6ffirYsxELMvZn4eOPhSFGt366qpqarOpJvX6xTeq1A9STaz2q1ntU17jVR7JeUT1PN0359e7XR6PuE6s1tS4ua9rIejOa1Lq+kOrWPntvH8eKEZOQh/A7OYVO9K4irY+3ft6s9xWN+LeGkBwkB8lBcpAcJAfJQXIIIaNXcop7I/VH0X4Tyellqwa7k8Mn1pAcJAfJQXKQHCQHyUFyCHmoJaf3Wyv3THKGvSKsBslBcpAcJAfJQXKQHCSHkIf0OzlDfm1mpL6T07/ktH5rqMdvASE5SA6Sg+QgOUgOkoPkEEIezO/k9N6uNmDf2vC+8NP0cbXi02i0q/WY3cp7iszT3oEWr2Y+/DAyEScy1pFlNV+d7rUtmfHjI7N4sbBpkxBxLbNmTWRee02w0dyq2Kw+LmJRxjbD6tSOHRNsfyOuKlpqp7N4xBFlbebHHyNjrvXRR8L160I8p+hY7w6gNW4R+xQTFelPsyVPmiREXMh0ztFNYVpk7Px2Loazmd27I2P2aBI7YYJw7ZoQcVo5KDwemVu3BG9Xa5rjbVZrGtyb+tPq+bJpUq8trq4Xq9/bNCI3tZz10+rWtPtNOtGkT02Ka4syXayvuvrZ2jybivjqo1E/Wzo8IyYho1lyCEFykBwkB8lBcpAcJAfJIQTJIQTJQXKQHCQHyUFykBxCCJJDkBwkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA55N5kphKbMzb0W2eSVZO9/35kvKtK69Q6DVoyjF6+HJkdOwTLmDGCNcJ1Ws7OZzrTtsiVFXlZY5h3kekcb5thE7Mpn23VkiWR6fjDeUWn7XEh+FmwSrR5ysbMmTOR8Qq45yNjrW5W02fKF7E9s39/ZM6dEyJey9joYiJq5mlCaDt46VJknnxSMIe3zYj4KmOCZGVrdjHY5d029dZzbT3n1SNjkz41NcI1OUCT8zRtVa0xdVVX7YdNuti0zfXBqV/cdBbqo1FTm0k/fYD1e5ueLQ87IyYhSA5BcpAcJAfJQXKQHCQHySGEIDkEyUFykBwkB8lBcpAcJIcQguQQJAfJQXKQHCQHyUFykBxCkBxCkBwkB8lBcpAcJAfJQXIIQXLIQ5+LF4Vx44TDh4WISxnrqor4QHgpMmfPCtYJ5vVTjwoTJwpWxjV5cmRMvWwHI45mdu2KjNWameN1DEElJ+Zmfv45Mhs2CG+9JcQUJb7O2C48/bQwbZrw6KOCFYhF3Mj4tO2dbx8q0ry3dWtkrD5u3jzBi9riVMbPwh0lflTeVvYq7xYsWBCZzZsFs2Wry7Pr2WZCOxoxQ3j8ccEPrI2b9UBZT/lNA2U9bdse/vmfC/YXHv00pDXtQi1mTZ5Wv7j2h3oH620+dUqwZ/spaqur5+pT1uRa/Wh505Kb1Ku+YsutYsQkZDRLDoJEkBwkB8lBcpAcJAfJQXIIQXIGzp07d4Y3LQ/7jQTJQXKQHCQHyUFykBwkhxAkB8khSA6Sg+QgOUgOkoPkIDmEIDm9icofUzxoPnNHgzggOUgOkoPkIDlIDpKD5BBCRu+dHHObrucMZj7k/kjHH2yOXydogZhN2/GcsHev0KkmO6NczpgDWFWXTZ82my5fLnRM7Ibyh8zChZGxfi1bUcQq5aTwZGRssLF6sYgvMi++GBnrT7Mir3hReUSJAxk7OJ0VSbnc669HxuzCz358pyxQPs3Ye02tTUWsA61TevaZcjxjZ//55wXTtp07IzN+vPDmm4L1Ab7ySmTMS2/eFGKa0k+dms15TTVf9XzZ1DbWVD5Wr6ifKramtrG6a+73vxfsD7DRpE9NpWdNmtpkCOY833wj/K//JXz7rWDvbaqPa1L6+vJuqlOjXY0QJGcgyRnwP5EcJAfJQXKQHCQHyUFykBxCyH18J6f4GBvfyUFykBwkB8lBcpAcJAfJIYTcx3dyermlQ5AcJAfJQXKQHCQHyUFyCCG/seQUN2QGu12D5CA5SA6Sg+QgOUgOkoPkEELuG8kZRrvagG8k90FmzxasyarzUcV5mW3bInPypGAD9DvvCDFBsF/H1mRlwnDtmhAvKGpipl779gkxSZmtxJeZtWsjE/F95sSJyFhBXMwR7Jd1xFsZb4R7RrBKtKtXhcWLBXvWN1J3f+5cwUbzjRsF2/3btyNjpWczZ0Ymnla0te/8+cjYdbVlixAzlVih7MxY5d3SpYJdoocOCZMmCREbMjZBRfykLFXkz5Ff/U2De1NHVk1dTlU/a8No/d56cq0H95bJtU35morp6kq02h+aTneTqNSG0M8Jbeqa6+fA1gZY16n14UuMmISMZskhBMlBcpAcJAfJQXKQHCSHECSHECQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDkEyUFykBwkB8lBcpAcJIcQguSQe5RFygFlTabTc3VCsJovq5DSJisrW7tyRbAmqxUrhKNHhU5x2bbMokWRcX26I1y4IFiN244dQsStjA3QH34oWI2bVc+9+qoQs4THHxfMASKOZN59NzJTpgiPPiq88IJgp9sktmO8VhD3ccaP1VTBWs5WrhRsRlq9WrAdjImKqpe1BdpWuUxaAaCehYiNyvkSkRyrB4zYKtRjfV23VQ/9dUNaPanXHWj1fFm7R1O9WD1A18eq7qlrWlS9+/WKmqb8Jour31s/2ySEpkBNitvPKWvq5etD6RkxCUFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ4j3iUnOnRM2bxasm8tavyJOC1qnFrEsY9N2Z1EiSJs2RWbPHuGTT4S33xYirmXMHyJWZ86ejcyPPwoduTqoiD3OmRMZ87QFCwRb1OuvR8bL5XwWP5QxfXrjDSFiX+allyJz/boQcSaze3dk3BD0SB45EpmJEwXb5nnzIjNrlhBxUjHX+kQ5lrErxxTIOt9OnxY6F/BcYXwI2hdntmxlekOMjPUkV1d11SrSVKdWb1XTZjRtVdOL6yG4yR9qIWzqBKvPbz/dek0m1lTT11TyVltN/Wxtnk2XaNPFQLsaIfeP5NyJOwUM8gTJQXKQHCQHyUFykBwkh5D7T3KG8dT/fc2deyRC92xFBMlBcpAcJAfJQXKQHCSHkAdBcga8h4PkECQHyUFykBwkB8lBcpAcQh5eydHvFUf+ufsCM5YBH7flFAvENpAcJAfJQXKQHCQHyUFyCEFy7orkDHjXxSxoeD937+QUT5F7lGnThJMnhYg9ilSEnTkTGR8KtXws4rDynTIvc+JEZDqK/Hrm4MHIzJ8vWO3VDz9EJuK48EwI8ZGyJPPii5E5dEjw3X8yhPgxs317ZNasETrvlbz2mhDxdmbVqsh8/bVgk7o5wMsvCzFGiS2ZZcsi8913wtKlQsSXmcOHIxMxX5ESv0mTIvPss4Jt5O3bggnw7NmCWZyZmCnujBlCjBXs2jCbmjs3MiOpBPXkWldXNRVb2bhpF5ZtZD2a15hdNJlJ/eKmXq+6XqzefduMzz8XmjayLkyrD3uTp9lGGvVhrzej6arr549GS6sbIyYhSE5hKa2PIzZIDpKD5CA5SA6Sg+QgOYQgOQ+g5PBxNSQHyUFykBwkB8lBcpAcQpCcB01yuKuD5CA5SA6Sg+QgOUgOkkMIknMXK6Tvxndyevy4GpKD5CA5SA6Sg+QgOUgOkkMIkiMm088/BtoqOa3tasWH0/i42m8cnz69JOq8sitjv9pWrxY6w/eBjDVo/bIhGZsZLl0S9u4VOvViH2TsV9uiRcKGDcKtW0LEWWVvxkzMG8P0SH7wgWC+tGtXZMwtn3suMt9+K0TcFn5ZdcKr2OJT5X1Fq8lmRmbhQmHrViHiqHJI0ao9lcmnnhJMRR55RLBLJeIz5Ybyg/Jhxrr17NqwZjarj+tom/1JuZr57LPI+MGpC6bqmq96rG+iHqDrZ+tJve65qidX+39BP+VjTUejbpOr5+mmsd4ObNP5bdrfuoqtVoImnbh7VXv1oTMTsyNZrogRk5DRLDn3LNgIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDHvZYk5VOvXdCeEJ46y3BFrV7d2RMVKxszX4dxwuKVrHZeL1jh2AFcU8/LZh6WVXX888LMVWJnzJuNXEz06lxs+P8tiLtW6+/HpmYrOg5evTRyES8otxUTmasAy1iX2bWrMj4HK9uaYtasUKwEj/ztHffFax7LeKCIhJ7/Xpk4mklNmasIe3YMcHG6W3bhIhLyqrME09EZuNGwdYbsU1oGlXrKbAuATNqm6olp6mKrR/3aFpv04hcO4CNyKdOCf2oZtNYbxdlU6ubvbg+C03vrZvZmny43sH6iq3Ns+VvBxgxCUFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ0iszNTlY+YPNk8fPBiZiPWZffsiYwViMS4ynUItaTmzgfLtt4WIucomRebLI0cic/as8P77QsSCjDne9u1CxI+Zc+ciE7Ewc+VKZCJez2zaFBnrQPvpp8hEvJyxYxVxPXP0aGTsLER8kbGDc/68ELE1Yw1pndg50u41dcspU4SIzRmbkRYsEPbvF+zFNjLdvCl0Ku/WKtrqpn1xdrp37hSsl68vB6jtojYEGwrt2XoWr9/bJDlNvV429TZtZL2i+r223m++qagLxOr11s/WQ38//WlNZXpNetzklrbeevdH7nQzYhIymiXnTgkhSA6Sg+QgOUgOkoPkIDmE3H+SM4yn/u9rOhny9cMeqZtW1Mu6+PdJkRwkB8lBcpAcJAfJQXIIeWAlZ8B7OD1KTquo9CM5I6soSA6Sg+QgOUgOkoPkIDlIDiFITq+e8Ovjdtelex9mwJcNtuTiBQPe4anX0nRTiCA5SA6Sg+QgOUgOkoPkEILkVL4x4MuGLTlddSleUGwMac06ZalyWNmRsVozm02tUcrqtuIRZZpw6JCwfLkwe7Zw+rTQGa9FkB5/PDK+GXEwM3ZsZD74QIjYnnnppcjYLG67b4LU2earmY8+ikzEIeGpEOJoZt26yES8qZzLHD8emRs3hKlThT17hIglyhVFrpwZMyITzyoxTzmSmTAhMtaBtnSpEHEqc/FiZJYtE+zQTZ4cmdu3hZiiqNOaH44bF5k33xSGmNVqnTA+/1ywRqmapoa0Jteqh+C6XqymHvrrzWjao362qmn4bhLC+kg2mUmTitQHp76Am45kvUdNfztQPsuISciDLTkDflWmEJIevaX37+QMuZCmtRAkB8lBcpAcJAfJQXKQHEK4k9Pw/Zk+JWd460Jy/t/2zj/i63vv4y85JkknmSRJZpJkJkmSZDJJjnQmSZKZJJl0kiRZkmSOZDKXySSTziSXJJek/XAcO9u1JJNkJpNJkiSTzO5xc9+v5/N99mrv820/ezw8/rjP+X6v7/fzq67X49xnr0PkEDlEDpFD5BA5RA6RA0Dk/DqRk//5GSKHyCFyiBwih8ghcogcIgcA/vvIGWSF9BOPnJ/4mT/2D/YQOUQOkUPkEDlEDpFD5BA5AE975AzyPwb6X/wzOcXbusLpxw7jp5cV29UG3cAt131MiHEia7vXIh6JGiqeE7EzayNj8+a16qrs0qWRvXRJjDioblbXZ5uNcLK4zA5yzBjR+1D3a73xhmj7taZOFe3SNYva9DrHqLop68vW5olr14q2a+7Gjci++664YIG4ZIlo6WVbzuzibNsm3r0r3rolRpzJLlwY2c2bRduf1uzH26s+zG7YEFmLdutDe+rGjhXtOjepuU+sN1kNkkBdb+5ae2VaL3Wt26qPuf4oi7raOurqULEHy+yqmq5LV+/Hq0+hPsiuFXD1z9Zf1HWt7JPrR6V+cnp6iRET4LccOb/N4ZmCIHKIHCKHyCFyiBwih8gBgD9I5FA4RA6RQ+QQOUQOkUPkEDkA8AeJHP6bY0QOkUPkEDlEDpFD5BA5APDH/K+rAZFD5BA5RA6RQ+QQOUQOABA58Cug69QWRfb8efH6ddH2idliq1mzxIjXVC2EH6bkpO31snnaYsO2YNkyrojr6rGs7bmyLVjxomjTyPCwaJN6s7ZOto3ZlB8T1NiovqnuVM+rsprMmuftt8WId7K3b0fWHga7v++8I27aJDap+VLWFuLZGZ06FdmdO8V4TtUtZxbAth/PytOW6b34YmQjjqgvq7I/zZpn40Yx4rI4NsR6CP74Y7Ge4+3NZtfKrK75sh6R60+2P1f1UdXDdx119uYnePqDrGLrWi9WX+e6iOp4rk/fXu3an1ZfnPr+drVWV8XpCTJiAhA5QOQQOUQOkUPkEDlEDpEDAEQOEDlEDpFD5BA5RA6RQ+QAAJEDRA6RQ+QQOUQOkUPkEDkARA4AkUPkEDlEDpFD5BA5RA4AkQMQV7ITJ0Y2JqnPiraZ7ZlnIjt/vmiLvF5+ObIHDojNdjWb41epnxRae1y4IB49KkYMZefNi6wFoZ1CzBZt61fEPXFxZO0w5swRIy5mR0Yi2+wik7gaPz6yzZqvw6LuQLOItYvjeRzD6q1sUxfvqnfFH/Iyaxv/5qr2vT88aVnNmEePIhuxS309O316ZO0O2qvTpon2MHzxhWhL/B6zXc0a4KOPRPvZehjtWpjWtfPNvrdeEVYvPavXqQ2yIG6QUKm/t46Nrvvb9bP1Za8vTv3mulsG6bTa+gS7mqfONrarAfyeIuf70l9nNTH9QOQQOUQOkUPkEDlEDpEDAL9m5Pz//1YKkUPkEDlEDpFD5BA5RA6RAwC/98jJTfJE+oTIIXKIHCKHyCFyiBwih8gBgF8tctog+d9/x/79//uXebJtf6T92fb9P/bJQOQQOUQOkUPkEDlEDpEDQOT80pFjrfIf/28rop+eT/BLMzQk2vIxW4l28GBkly8XbVPZzZtixAn1fvb48chGfJv9y18ia81jcRVxR9TtWxG71W2qBJIvAZum6vYt2+tlA/SRI5FdvFj0aXtyZNetEyPOqHI15s6N7IYNoo0BEXtUaR5LrzNnxIh9WYvJO3dEj89ZIT4j2uo569LmamggxUpRv8h2oNl1tgu7cmVkV60Sr1wRIz5Wv87akjMbax8z9nVN6jYjWhFZXdTLuOrVZE9wzK2H/vqYBwmzct3WY8brrvViXSXWVRd2Uz7/vLJrrVkdsV12nWD95jrquhqP7WoAT33k1P/HT/z3f/onA5FD5BA5RA6RQ+QQOUQOAJHz60SO8djIqd9P5BA5RA6RQ+QQOUQOkUPkABA5v6H/T86PfchPjB8ih8ghcogcIofIIXKIHCIHgMj5pbertf+wzU//Z2/+4/9L58f+JRA5RA6RQ+QQOUQOkUPkABA5Tyxy4sf/d3Laf7PYrlb/19VYOfAbZGPWfonY1Pv115GNF8WLF8UTJ8SI1epmcXxkx4wR331XtNhYtkycPFmMCWq8LE4MMUaye/dG1k4wFqk619r3NqP5+6LO4rt3i80pHM/aXi9b5OXr8mI0a0U0ZYpoYWYpcuqUaHcwZqqxI2v36PRpcd8+MeKfqm3e0wVxfq12Zq3DI95TJdt8q5sXkdzuBw8iG/GVelyVhu+LnHrMHR0V6xnR3mzWU2/XpF4Po10p0nWC9YUdZDWZlVgdZuYgl67eRGcfZd/74YdiHcD1zreuLu36qHpb4CClXT4bjJgAv+3I+b1C5BA5RA6RQ+QQOUQOkUPkABA5FA4QOUQOkUPkEDlEDpFD5AAQOb+9vKFwiBwih8ghcogcIofIIXIAiBwAIofIIXKIHCKHyCFyiBwAIgegYNIkMeJo9urVyL70kvjKK6KtCNu1K7LDw2LE3qwdxttvi1ZivuZrkmiFMG+eGDGc3bEjsr71S+dpDwZtrUOHxEePxIhD6gNxSYhxUv1CPavKAG1bziL+IuoXNU37dnbChMjGc6JfWL10npqxXpUGsEy1dWrjxokzZ4rPPSfaPkC7g7Yvbv588exZcf9+MeLTrD0MdjWmThWblpY/ZT6N1WOfDbL14jb7WZs+631iXWVSW39yfYKDvFpXTde2sa7mqef4QS5dXbz1DR3kILsuTn0X6jfbQXatFqwlcgCIHCByiBwih8ghcogcIofIAQAiB4gcIofIIXKIHCKHyCFyAIDIASKHyCFyiBwih8ghcogcACIHgMghcogcIofIIXKIHCIHgMgBqFi9WrS1Zi++KEYMqQeyQ0ORjbiVXb48sr5eTIdgyxjrJZvrmu1buiMrlmdtnrYysU6LOK/eEHWRl619si1nEZdVmcV37ozs9u1ixO1ss6hNss3ias8e8fBhMWK7avdXNtGdOxfZ2bNFu5L2MNy8KT7/vDhrlmhX0lbA2TP56qvi+vWiL4iLNdljxyIbsVu9n71yJbIRK7J2kEuWiLaHMGKlWO8Ts41SXSNjnRP1qq76i+puqfd61a3VM5v6s1Jfqzpy6jd3XdhaO/1BbkrdHvVius8/F+srWX/Uk9ty9pjrXOdTbflRjJgARA4QOUQOkUPkEDlEDpFD5AAAkQNEDpFD5BA5RA6RQ+QQOQBA5ACRQ+QQOUQOkUPkEDlEDgCRA0DkEDlEDpFD5BA5RA6RA0DkwFPP2LHiG2+INrm+/77YbAyTqrF8OnhQPH5cbLZvbcqePh3Z6dNFXxCn7XH5smjjpn1UxL1sM9fKRrjx4yN744Zo2GK6mC7apG4zoZVnjBVt+djrr4sN32SbY76pbsg2q9iuZefMiaxdK48NvQsnToh2+hEnsna+FrERh1WpGqvlS5dEi9hvvonswoXilCmiXavz5yNrD78tAHzM2quuWXyQRV715q6uRV6DrCazBvj51rjVOVFrB2naJ5v1LF5fOnu1rqn6uapvStejUn9vfa26jqrrDtYHqYfxRxwZv0f8XQlA5BA5RA6RQ+QQOUQOkUPkIJEDQOQQOUQOkUPkEDlEDpGDSOQAkUPkEDlEDpFD5BA5RA6Rg0jkAJFD5BA5RA6RQ+QQOUQOkYNI5MBvjmfU+CRrw2jEVvWr7MOHkX3rLdE3lcUldVm22ZEl2CIvz4nZqrJ/v2gfdfSoaAO0bdC6dUtszvdY9oUXImudZs0T8aEqO9+eey6yMVldoo4X7Vrdvy96H8bR7KpVkZ04UfSjmqEuUP3ub1BlMd3ISGRt55ud79Wrou1As07zDXh2kNqWdgebXPw223zvVdHWBdZTYD3JdW396hpG64OsP+qjj8RBpt56v1bXbq46ReqqqW9KV6h0hVndHnYKdsvq863vYNe+uPog65/t+t6uPK6bhxETkcgBIofIIXKIHCKHyCFyiBxEJHKAyCFyiBwih8ghcogcIgcRiRwgcogcIofIIXKIHCKHyEEkcgCIHCKHyCFyiBwih8ghchCJHHjasVE14qKoW7Biirh3r2grpDZvFpsvkoFy9uzI2lC4aZPYDMH/VA9mLVS2bRPXrBEN39umG8MiRrN2+hFns/fuRfbOHdGWgC1eHNmG06rlouy4s+9tNqRJTA4PR7Zhd9Zu2XvviT7WzxTXrhW3bxcN39umvVQf88WLoqXIihViE5P2mK1R12btUbHTt1y0Hu6bL+tJ3XLigw9Euxy2xq5OkUH2a9m0bV9Uv1of8yAjcl0m9Ta5+i50bTmrh/767n/2mVgnX336gzSPvXmQa9WVuPUxd9UUIyYikQNEDpFD5BA5RA6RQ+QQOYhI5ACRQ+QQOUQOkUPkEDlEDiISOUDkEDlEDpFD5BA5RA6Rg0jkABA5RA6RQ+QQOUQOkUPkIBI5ADbYDamfqCezvgRskuiv6l6vhr+ryhhVj3nGjMhOnSqePi0aW7aIvl8rzqmyIc32iUWMZKdMiWzDhezChZG1+co2lVlbRgyrn6oWZstUuaH79kU24p56Imv5ZGdk9+jUqcj6KYwTm26RbXLNprIvVDtffVUXpq1bJ9r9jekh6s/OmyfaVrcrV8SmLc+I9axWj6r1FFgPsvX+NIuNuoispuzVenFZ1/40s15NVs/E9YK4Ovm6Vt7Vy9a6PqrLrktnr37+uTg6KtrfUHUQ1ne//ig7qq43d/1ZYMREJHKAyCFyiBwih8ghcogcIgcRiRwgcogcIofIIXKIHCKHyEFEIgeIHCKHyCFyiBwih8ghchCJHAAih8ghcogcIofIIXKIHEQiB2Creiprw6j9pnvpJdF+49gqNluSZCPytGmijZv2RTZQ2jHbJ9+8KfogqzTD6O1sUxf3Vfnkb7+NrC2Xmz9ftNiwS+f43wwr1UdZ2/q1f78YY9W4ploA71ZljZtvz9N79OiRaJv3LIFsnI5pYhM576jCs8+KzQnuzNruNbuS9uaIo1l/ROOAuik7ZkxkHzPXDjK426Te5RPcY1bnRK2dvpVYvQKu3p9WF4K9eZCf7dpjVkds/VF1mHXdskE2/g1yJevkq2+ovVr/WfC/ZRgxEYkcIHKIHCKHyCFyiBwih8hBRCIHiBwih8ghcogcIofIIXIQkcgBIofIIXKIHCKHyCFyiBxEIgeAyCFyiBwih8ghcogcIgeRyIGnnMeEim4Mu38/sjFD3L1bbBZ5yY4s+9lvvhHtqB63A+2fqo3m9fatS1nb63XggGifbIO7T/nxurohOzQUWdtEZ7+sDx8Wm11zcjWuXYusHfPatZG1T7Y72JzRcVG3jS1aJDZ3QZJg3LjIRhzKHjsW2R8eUtU2/q3K2pOzZ49om+js/toWO7sLza65LarFswTwyZORjdgn2mqyeo63KdDebHZt7rI31xPkzzfm1q/aYdjkaqdvk3p9YbsKob4p9r12RvaXbL3lrKt46+Sr75FdnHqZXv1qnU9ddq2tq99cL2pjxEQkcoDIIXKIHCKHyCFyiBwiBxGJHCByiBwih8ghcogcIofIQUQiB4gcIofIIXKIHCKHyCFyEIkcACKHyCFyiBwih8ghcogcRCIHnnpeVHWgtJnY15qpS5eKy5eLK1eKNjLu3BnZZpPVdlUH6DmRbTak7cnatjGrC9vc9eWXou/j0U+2j7JtchGHs4cORdaCsA6ViDdVjclJkbVdcxGns82mssOqBuGfQpylxi71RnbJkshu2ybGdNE3lc1WNXLWr4+sP88LVd0luH17ZBveE32n31JVrlWziG9N1lraxy+zbo/arhlxkI+qD7JrRVi9Mcz+EA4ybddr3Opj7qqp+iC7Sqw+5kFera/Vz7dcrqvh7c1dr9bfy4iJSOQAkUPkEDlEDpFD5BA5RA4iEjlA5BA5RA6RQ+QQOUQOkYOIRA4QOUQOkUPkEDlEDpFD5CASOQBEDpFD5BA5RA6RQ+QQOYhEDjztjBkjxgRVmTlTtI1hU6dGNuKa+rZaIyPjuXORtZyIuJq137A7dohNqJzNNlu/Dqg3VEsC3a81P0QNlcWLIxtjVf1ZCzNbAtZkquwx801l81S9g+vWRdZm8bFjxWZ73iuiJsHly6IFcDyr+gY8uc7+s/7EynU+ciSyful8b9vK7KlTkbW4Ons2sh5mekb+XGmI9q1Ee4L7prpSpLbuh0Gmz3rKr6ft+iDrT67Xxw1yvvaq/ZXUda1quzaV1SdYp0jXPbKnrr7O9VNXZ3m9Tu2zz0RGTEQiB4gcIofIIXKIHCKHyCFyEJHIASKHyCFyiBwih8ghcogcRCRygMghcogcIofIIXKIHCIHkcgBIHKIHCKHyCFyiBwih8hBJHIAZLCbMSOyvgZKh29bIfXVV6Jt37JfMTZu7t8vxhTRjsq+9/590Qb3d9+NrA39W7eKTZh9rUrGXLgQ2Rs3RPtFb3vMTp4Um2w7odrQfz9r39tkjBTC/PmRtcOI2KjK99ql87E+hlT52SYY5M2vvx5Z+9lnnonsqlWi/T1pz4b1oSW9xbNnaqxTtWmfj6zdwXnzRHsm796NrM9bNpx1rSbrKqKuIdjebCvCbBavX7XNg6YN/XUhmPUQ3HWCXenVFWa1g3Rp3R51XNV3sH6uBtnbVr/Zztf+pNgvFbO+Vr6FkxETkcgBIofIIXKIHCKHyCFyiBxEJHKAyCFyiBwih8ghcogcIgcRiRwgcogcIofIIXKIHCKHyEEkcgCIHCKHyCFyiBwih8ghchCJHHjKaUbVL7KbN0f2wAHRVmZFbFVlkLUtZ7apbMWKyNpH2cho32tzrQ+jc0JU3ntPjFiT9UVefoLLsxYbNkLYEGyNNzIiXr8uNsP3A/Vg1m+objmbOFH0YJgu+ua9eCe7cGFkIw6JM0KM7aJuhFu0SNy2TfxesU+ePFm0h2H1avHaNdEe0cOHIztrlmjP1dGjkbXL/sILot2Ft94S+9qjHoJtVLWnsG6PrlCp12117bmyV22QHR0V6zG3DsL6Otur9UHWe7269piZ9kWD2FUmXell1vfXtBtq1qdQP2b1m+ubwoiJSOQAkUPkEDlEDpFD5BA5RA4iEjlA5BA5RA6RQ+QQOUQOkYOIRA4QOUQOkUPkEDlEDpFD5CASOQBEDpFD5BA5RA6RQ+QQOYhEDjz1+DD6etYG97VrRRvdbOp9+FC8eVOMGFZtj9m97NSpkbXvPX1atBF55UrR6iLiYdbOtylA2fplO7KaN3+V9R1osUPVMItPsrbWbN060RaIRezJ3rsXWe+WBaJFbBM5Elf2yY8eic11/i5r9yjiw6wF4cGDYsSm7NBQZJsglD11s2dH1rfJ6XPlO9D8T0q1pXDLlsjaf1gQcUus16nZuFkvxbJJrl4+1vW9XZN6HRuDNEA9i9fdUh9G1xKwrlPoqov6DtrtrtepdU35P98KuK7WshMcZHlg/WzYq4yYiEQOEDlEDpFD5BA5RA6RQ+QgIpEDRA6RQ+QQOUQOkUPkEDmISOQAkUPkEDlEDpFD5BA5RA4ikQNA5BA5RA6RQ+QQOUQOkYNI5ADIUGjTpw2FtufKtlHZm22we+010QfoF8RmC5ZMkLZBy1eE6Ya0GBdZ+941a8Rdu8T9+0ULFZvjbTSPWK3uVWUzmwXSvn2iRU7EbtGH76VZ+9lmype6+PLLyNoONLs4ESezFy5E1u7R8eOina/vT9PEjViRtZbevVu053nTpsg2j8qZrN3frVtFu84XL4p2JR88iGzzvTdF65Z6JdoHH4j25nqwq+0acwfZCWZDcP1F9Va3+nzrN3cNwV1FVK+tq1Oka6wfZL1Y1yd3abe7q7UGycU6kOptgYyYiEQOEDlEDpFD5BA5RA6RQ+QgIpEDRA6RQ+QQOUQOkUPkEDmISOQAkUPkEDlEDpFD5BA5RA4ikQNA5BA5RA6RQ+QQOUQOkYNI5ABIP1y/HllLggkTRNtGNXOmeOuWGHE3azvBbApsdpF9k7URuWkAG5Flj1nzZvlkyzbTBtmIrdnlyyNrw6ftT1u8OLIRN7JHjkTWPmr8eDFmqfGqKgc5MhJZC4amLW+oL6mb1PXZy5cja7HRPBvapc6RrF3njRtFe2LrnX6+YCk2ZG1vm2WbjVv2XFnU2X92YPfXp956NK83WXVNn/UEaYdRz4hdnVZ/lL3adTXqbrFPrg+yKxd/sX1x9bK1rt1r9d23R6Wui66YHGQhXl2AXX8W2K6GSOQAkUPkEDlEDpFD5BA5RA4iEjlA5BA5RA6RQ+QQOUQOkYOIRA4QOUQOkUPkEDlEDpFD5CASOQBEDpFD5BA5RA6RQ+QQOYhEDoAhg/v06ZG1gdIix2Ij4nrWto0126hsgD6UteYxrT2WLRNtUm9iw7acfZf1BWJTxOZ812Y9nxaINiJHDIkeKu9m/Xsni1OnijZP289axNocbxvwmnskVXPyZGTt2bDVcxFfZi2BhofFe/fEiNGsvdnTS8N7504x4hNxamQtvG0vn93fJUtEe9qbR2Vn9tGjyD5mz1XXprKuJWB1XHUtAatDpWtj2CB27ROrx+s6Jut71LUirJ7j6zto3/vpp+Jnn3VYn2BX5HQVYFcf1te564aajJiIRA4QOUQOkUPkEDlEDpFD5CAikQNEDpFD5BA5RA6RQ+QQOYhI5ACRQ+QQOUQOkUPkEDlEDiKRA0DkEDlEDpFD5BA5RA6Rg0jkwNOODWcRy1QZc20nmE1yNlDaAB0xosomqzlzImuD+4MHYsQxdXvWfllH3Mza3jYfN2eIS5eKTajsydrgHrNVjas1ayJrF+f55yNrR2VFZEP/3buiHZVtwDt4ULT0avrwTNY2pK1eLdoxN1vOrqkPsnadZ8wQbR/g++9H1o/5GdX3491R5R5ZlvvquTGqx/Ou7Nq1kY14T+xaetY1QXZNzHXG1EvP6q1f9ZvtFOxn7TbUi9rqT67tmtRr7e+gupfqSX2Q5KsfJDuM+u4PsmuufnPXrrmuDu+6koyYiEQOEDlEDpFD5BA5RA6RQ+QgIpEDRA6RQ+QQOUQOkUPkEDmISOQAkUPkEDlEDpFD5BA5RA4ikQNA5BA5RA6RQ+QQOUQOkYNI5ABYMFzM+sawuaIF0ooVon1ys+dKx805kR0ZqWw2d53Pzp0b2fHjRRuCbZGXvTpunBhxOWtL3iwYtm8XbXAfM0ZsRuSl6j1Rt35FHMzaPG1RF3FJ1F1kEbvVleqrqlyNefMia+f71lviwoVic76H1f2qnO/oaGTtqdu8ObIxUXzzTdGW+B0/Ltq6vEuXRHueX3klslaPZ85E9jE7ssx6krPJtbYegm2+tD8b5gcfiPaqdYtZ717rGlUHGc3rqLMzqr+oqz3qdXl29+si6rq/XUv8Pv9ctM1sdpD1orauhh/kBOtrZTJiIhI5QOQQOUQOkUPkEDlEDpGDiEQOEDlEDpFD5BA5RA6RQ+QgIpEDRA6RQ+QQOUQOkUPkEDmIRA4AkUPkEDlEDpFD5BA5RA4ikQNPO7Z9a9EiMeKWeiTrk7pu/YoYzt65E1kbN2Oy2DTAK9lmy9nfVRnNz5+PrH+vHfNYVT+qOSqdxe2T9fQ9NvR8m61f61V59eHDyNpCPL/OSvOzkgS2qaw5qi2q/KwteWtC5VzWQtS2ydnWPrvdkyaJEVuz9sm2t61Z8fexqMlXP942UDXPpH6yRk7EAdHm6Xo1WT241/um6rroSoL6i+qVWXa+9ffW+7Xqo6p3vtXXuT79+qPq0bw+wXrnW12P9UfV17m+ZV0BXF9Ye7Xr4a/Tuv5ZtqshEjlA5BA5RA6RQ+QQOUQOkYOIRA4QOUQOkUPkEDlEDpFD5CAikQNEDpFD5BA5RA6RQ+QQOYhEDgCRQ+QQOUQOkUPkEDlEDiKRA1Cjg+yLIeqUbzujtm0Tt2wRIzaIEyJrm9mabVRb1a+z9pvu22/FiGvZI0ciawP0uXOiLVs7cEC08dpOwYJwx47I2hA8fbpoRxXTRbvOdvq2Ti3iNdX2ttnQL69evx5ZC+CI99Vh9bQqCXThQmRtM5s9Knad7Q42Mbkva9f51i3Rjnn+/MjaujzbJmdHdfWqaHsIHz0S7Zn0bXL1Qi3bZFVPzPX6qXq8ruda+6j6mOuBsrZep1Y3j03MNgTX83R9Nboujr15kOVyXcVbd1qdT4PclK4dd13F2xVIdQLZmy9eFBkxEYkcIHKIHCKHyCFyiBwih8hBRCIHiBwih8ghcogcIofIIXIQkcgBIofIIXKIHCKHyCFyiBxEIgeAyCFyiBwih8ghcogcIgeRyAGQYXTjxshGbBKfjaz9TonYJk6JbLMUS7531qzIRtzL2qs2yNqUPzQkxiTxuefEiLVZi42zZ0XbvuXrefR8Y67YbGbbL84IUa+zMToq2hzfjPVyJV94IbJ2JQ8dEpuNYTvVk6o8KpaLVsuWbRaTzVY3KRNry+ZnJY//9KfIRtxQdYud3l+7g/5nQc/Ism316sh6xNql69r61TVt1xu0LFTqydXeXNdU/VH1m7u2utVjbtfmrvow6r1tNk/X28bsqOrvrW9ZXa31Rrj6i7puSl0mXSvvus6oftq71hIyYiISOUDkEDlEDpFD5BA5RA6Rg4hEDhA5RA6RQ+QQOUQOkUPkICKRA0QOkUPkEDlEDpFD5BA5iEQOAJFD5BA5RA6RQ+QQOUQOIpEDYAPlbfGH3khu3y76erGFosdGfKna1i8NJJ1rrUzmzhVv3xZtrI+4q8qYe/58ZCOWqd+oMtcuXhxZm1znzYusD9C6is12c333nWhbv2wnmP1ss/TsmKpxZddKb3ezau+RKj976lRkGzZmbVT74guxOeZL2ea5+le2WXn3bdYK8M03RQtRe8zs4kybJjZ/jv6lyrOxb19kHzPYda2u6tquZq/W1s3z73+LXYkgBEMAAAnkSURBVPlUz6Z1twyyPq6+zvVBdiWfXZyuXXOD1GP9s/Wlq5+6rh4eJEUsgeqFaV3L5YgcRCIHiBwih8ghcogcIofIIXIQkcgBIofIIXKIHCKHyCFyiBxEJHKAyCFyiBwih8ghcogcIgeRyAEgcogcIofIIXKIHCKHyEEkcgCMw9mrVyPbLNR6W7VQWaoOqaeyvm1MN1kND4vNIi/jTVVG5JGRyNpofvBgZJsBeodqg+wnWfvNbvu1Vq0SLUVOnoysb6LzQLqYnT07shFbsnYlV64U7R75vrjYkL10KbJNTb2UtTCz0cXO1x5C2+pmG9L8hs5R9ajOnYvsrl2ibc9rdqBZlstBxg8Pbda5ptpmttfEJzhe17Hx6aeivXmQULFBtv4ie/UJLmqrd5E9wbG+awlY3QD14rInePr1z1oh1J1WP3VdWd51Jbv2ttV30E6BERORyAEih8ghcogcIofIIXKIHEQkcoDIIXKIHCKHyCFyiBwiBxGJHCByiBwih8ghcogcIofIQSRyAIgcIofIIXKIHCKHyCFyEIkceNqxwe7mTdEHO19cpo6PrP8S0VctRWzsiRniiROiHfPx46INsi+/LNquJnPzZjGmq7FVlW1jTU09zNoxX7woTp0qRryStYOcOVO0XFy2TGzC7At1JHv0aGTt/k6eHNkmCB9kPWJ1bZ0lX9Np8mzYtbLnynvYg1Aq3a7knTuibZOzTrMws41/9r1bt4r+5GjSP2b67Boo65+tx+uuebruh0G6pZ56bd1W19BfT+r1z9YTc9cXDbJ6rm6AJ3jZ62Co95jV7WF30Dak1X9B13e/qy39Vw4jJiKRA0QOkUPkEDlEDpFD5BA5iEjkAJFD5BA5RA6RQ+QQOUQOIhI5QOQQOUQOkUPkEDlEDpGDSOQAEDlEDpFD5BA5RA6RQ+QgEjnwtDNRvHJFjLgljotsM8h+nV24MLJr14qWMRGH1GPqnuyrr0Z2yRKxGXMvZ+/di+y4caKlyJQpon2yDcHNMX+jytYv+91t19nPSK+VXVg7o4gLol/nm9nLlyMbMapaIK3KeplMEG1Dml1nO+YdO8Rjx0SLOptVmiu5UvxTiPqqPe3NdrWbqvSSdakdc8RXWTv9hw/FGB0V6+VjdeTUc169Xqye4+sv6oqrOidq66OqZ3F7teuY7bJ3HaQdRtcp2Fhfv2rBUNdF/WpXTtTWl32Qa9VVgPY3hV0rRkxEIgeIHCKHyCFyiBwih8ghchCRyAEih8ghcogcIofIIXKIHEQkcoDIIXKIHCKHyCFyiBwiB5HIASByiBwih8ghcogcIofIQSRy4GmnCZVXVNsndrlUJvVr1yL7uNn0ftbe/OWXYn0KNn2+9poYcSNrOWGj6vPPi8bt26KtU7Mwi9ibbS67xmRsyTYp8nHWN8LNVDVybK3Z3LmiDTYeDAsia9d53jzRT9BiQ4/q669Fu0e3bkXWjjlihaosKNUsb4JQXrUndvdu0fDda7PEsWPFvlG1HuzqUKmHUfsiO4z6Z7uG/npSH+QwujKm/qiuvW31z3Zt/eq6dKY9o/WWs64A7grC+ozqFKlPsGsFXFcAM2IiEjlA5BA5RA6RQ+QQOUQOkYOIRA4QOUQOkUPkEDlEDpFD5CAikQNEDpFD5BA5RA6RQ+QQOYhEDgCRQ+QQOUQOkUPkEDlEDiKRA087NkDfvy/GFNWbx7ZvyQKxx4y5utVtwgQx4hP1oKhbzmz7ln1ys19Ljvno0chGnFRtYZqEypYtkR0aEiPuZO1qWBJMmiTaei0bXb77Tmyu1fqsrYBbv16MGFLvqxvUs6ImwenT4rZtou/W8yB8XZXrvGtXZEdGxK++EpsEslOQR/R7xTbCHT8uRmxS31TtUbHNbCPZs2cj2zci10ux6iToWj5Wz5c2yNYTs71qx1wPwV1H9QQXtdVbv+w616vJBlnyZn8XDLIR7rPPRHvVfrY+5jqfujqtvrD26gcfiBcvVtZ3wZ4cRkxEIgeIHCKHyCFyiBwih8ghchCRyAEih8ghcogcIofIIXKIHEQkcoDIIXKIHCKHyCFyiBwiB5HIASByiBwih8ghcogcIofIQSRyAGTobwY7qQsbKL15FocY19S3RQ2ViP2q7NeyBWI2jM6YIUYcVqUBfKvbXFW3nC1aFFkb3G2Atk8+d05s1qktU22Algv76quRjbibbfrhuips3y42kbMm22x1ez/78GFkz58X7R4tWCDa5r14VrQr2Wyxu5fdty+y9lxNmSI25yvXyq6zTX22a254OLJN5PTQNdbb1amHwtp6Uq+HwvrVrrqoJ/WufBpkNVlXAtX12LWarOta1UFY3+56+VjXlezacTfIz9phWOT84x/ioUPi3/4m/vWvov/HIYyYiEQOEDlEDpFD5BA5RA6RQ+QgIpEDRA6RQ+QQOUQOkUPkEDmISOQAkUPkEDlEDpFD5BA5RA4ikQNA5BA5RA6RQ+QQOUQOkYNI5AAAwK/Jn/8sAsAvDSMmIpEDAABEDgCRg4hEDgAAEDkARA4iEjkAAEQOABA5iEQOAAAQOQBA5CASOQAAAABEDiISOQAAAABEDiISOQAAAABEDiISOQAAAABEDiKRAwAAAABEDiKRAwAAAEDkICKRAwAAAEDkICKRAwAAAEDkICKRAwAAAEDkIBI5AAAAAEDkIBI5AAAAAEQOIhI5AAAAAEQOIhI5AAAAAEQOIpEDAAAAAEQOIpEDAAAAAEQOIpEDAAAAQOQgIpEDAAAAQOQgIpEDAAAAQOQgEjkAAAAAQOQgEjkAAAAAQOQgEjkAAAAARA4iEjkAAAAARA4iEjkAAAAARA4ikQMAAAAARA4ikQMAAAAARA4ikQMAAABA5CAikQMAAABA5CAikQMAAABA5CASOQAAAABA5CASOQAAAABA5CASOQAAAABEDiISOQAAAABEDiISOQAAAABEDiKRAwAAAABEDiKRAwAAAEDkICKRAwAAAEDkICKRAwAAAEDkICKRAwAAAEDkIBI5AAAAAEDkIBI5AAAAAEQOIhI5AAAAAEQOIhI5AAAAAEQOIhI5AAAAAEQOIpEDAAAAAEQOIpEDAAAAQOQgIpEDAAAAQOQgIpEDAAAAQOQgIpEDAAAAQOQgEjkAAAAAQOQgEjkAAAAARA4iEjkAAAAARA4iEjkAAAAARA4ikQMAAAAARA4ikQMAAAAARA4ikQMAAABA5CAikQMAAABA5CAikQMAAABA5CASOQAAAABA5CASOQAAAABA5CASOQAAAABEDiISOQAAAABEDiMjAAAAAAAQOUQOAAAAAAAQOUQOAAAAAAAQOQAAAAAAQOQQOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/Zf4H3plAR1Apxh0AAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"5dc2e02f0288384a2de46612","environment_id":100,"environment_description":"Windows 7 32 bit","size":99328,"type":"PE32 executable (GUI) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"darfrp.exe","md5":"4987bcfb27bbf54852fea8c71f1b952b","sha1":"0e4d3c37abca7f9098fe0fbbfba3e325576aa3a5","sha256":"37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4","sha512":"9acd9626fd6b4084acdb054ddcee9acda55dbd4fc9f569006a7f6daea6ff71848873fc843f741e3c641b105835049e02a7b71b4f6a74003f9085d06577b4692e","ssdeep":"3072:m5y36RPOJTdktKKu37BLgwl7gMt7pwObB:mQqRQydiBLJl7Jt7N","imphash":"46646950e38cdd1519d35c0c539d2b12","entrypoint":"0x401010","entrypoint_section":".text","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":88,"vx_family":"Trojan.SalityStub","url_analysis":false,"analysis_start_time":"2019-11-09T17:14:01+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["paaaaad.fd.fd","padrup.com.ds"],"compromised_hosts":[],"hosts":["118.136.16.138","180.247.53.107","86.107.231.10","93.114.69.232","220.247.166.100","202.177.246.59","189.122.188.39","89.38.237.65","188.215.25.69","14.96.75.194","212.76.78.10","14.98.120.25","112.204.145.248","200.8.145.17"],"total_network_connections":14,"total_processes":9,"total_signatures":60,"extracted_files":[{"name":"tdnjxj.exe","file_path":"%TEMP%\\tdnjxj.exe","file_size":66561,"md5":"47d1491efa917b9f59e7ac47db12e944","sha1":"f7a165b87b37c701ff6719849f5c7fd28f99b797","sha256":"388b2256da79252db6228c877d6c602df338a2d5eaf97210b35aed2c965a177e","sha512":"003bfa777f1664e8422899015201c2544509160dca645bfb73dd0f79fc00f2d4057aa01c13635debf8c6b88871a92d77768ff5bbc15383d1eb4c2aef02bf2a77","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"dwm.exe (PID: 1496)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":63,"av_total":74,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=39abc787127935c4cbc33828b9d0b75c36a4cc3eab83722cb1d78791e57b3c5197ac1bc573e5f15694ba86a3ced28608d856208c086231bb107a61297e24ea3734ab863dda","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=39abc787127935c4cbc33828b9d0b75c36a4cc3eab83722cb1d78791e57b3c5197ac1bc573e5f15694ba86a3ced28608d856208c086231bb107a61297e24ea3734ab863dda","has_overview":true,"extended_details":null},{"name":"winoqug.exe","file_path":"%TEMP%\\winoqug.exe","file_size":66561,"md5":"47d1491efa917b9f59e7ac47db12e944","sha1":"f7a165b87b37c701ff6719849f5c7fd28f99b797","sha256":"388b2256da79252db6228c877d6c602df338a2d5eaf97210b35aed2c965a177e","sha512":"003bfa777f1664e8422899015201c2544509160dca645bfb73dd0f79fc00f2d4057aa01c13635debf8c6b88871a92d77768ff5bbc15383d1eb4c2aef02bf2a77","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"kithj.pif.exe (PID: 1892)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":63,"av_total":74,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=dd77f9e8521fc157723e7a812fff72e7944b27e12ee7cb90be4f63c996b43e3f5431275e30a7e29014d0ed394fbe57919f64e4a11ef71c37e3518f433d45235b27db5ae2","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=dd77f9e8521fc157723e7a812fff72e7944b27e12ee7cb90be4f63c996b43e3f5431275e30a7e29014d0ed394fbe57919f64e4a11ef71c37e3518f433d45235b27db5ae2","has_overview":true,"extended_details":{"filename":"winoqug.exe","size":66561,"description":null,"architecture":"32 Bit","ssdeep":"12:eH1GSG465M6akP1AZX1ndDV0iCPAYKLORIBORLc:eH1GSAM63EX1ndD6fPVKPBJ","imphash":"46646950e38cdd1519d35c0c539d2b12","authentihash":"cb6d3d4c71a052d8190317cc1ea5a32f4eb6fbb862ef669095fc8b11c9ca5708","entrypoint_bytes":null,"packer":null,"version_info":[],"file_sections":[{"name":".text","entropy":2.77551579778,"virtual_address":"0x1000","virtual_size":"0xfc","raw_size":"0x200","md5":"55b26e42f7b701cc848b056f9c118b0d"}],"file_imports":[{"module":"KERNEL32.dll","functions":["ExitProcess","SetErrorMode","Sleep"]}],"file_exports":[]}},{"name":"winxycyvb.exe","file_path":"%TEMP%\\winxycyvb.exe","file_size":66561,"md5":"47d1491efa917b9f59e7ac47db12e944","sha1":"f7a165b87b37c701ff6719849f5c7fd28f99b797","sha256":"388b2256da79252db6228c877d6c602df338a2d5eaf97210b35aed2c965a177e","sha512":"003bfa777f1664e8422899015201c2544509160dca645bfb73dd0f79fc00f2d4057aa01c13635debf8c6b88871a92d77768ff5bbc15383d1eb4c2aef02bf2a77","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"dwm.exe (PID: 1496)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":63,"av_total":74,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=b95f908fd69f7ec6833a0f6b8d6b4086359aaa418e7806f3804de2e362d29e58719b7a14c1a3f5abdc2f30c6a51adc1aeab64ebf3100f39b63461e04329e6410f344424089ea66f5","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=b95f908fd69f7ec6833a0f6b8d6b4086359aaa418e7806f3804de2e362d29e58719b7a14c1a3f5abdc2f30c6a51adc1aeab64ebf3100f39b63461e04329e6410f344424089ea66f5","has_overview":true,"extended_details":null},{"name":"xpvyj.exe","file_path":"%TEMP%\\xpvyj.exe","file_size":66561,"md5":"47d1491efa917b9f59e7ac47db12e944","sha1":"f7a165b87b37c701ff6719849f5c7fd28f99b797","sha256":"388b2256da79252db6228c877d6c602df338a2d5eaf97210b35aed2c965a177e","sha512":"003bfa777f1664e8422899015201c2544509160dca645bfb73dd0f79fc00f2d4057aa01c13635debf8c6b88871a92d77768ff5bbc15383d1eb4c2aef02bf2a77","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"kithj.pif.exe (PID: 1892)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":63,"av_total":74,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=7c91e9e15986e09f31cbb01fc5468702aea9f7e45461b979a60016541137c029c8d68bc33657c1147f3d4bad9e669f2eef3f1b31c2365f1af912f3dd64e1c94a7df861ef","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=7c91e9e15986e09f31cbb01fc5468702aea9f7e45461b979a60016541137c029c8d68bc33657c1147f3d4bad9e669f2eef3f1b31c2365f1af912f3dd64e1c94a7df861ef","has_overview":true,"extended_details":null},{"name":"myoicr.pif","file_path":"C:\\myoicr.pif","file_size":99328,"md5":"563b41f78d485d10d8ca5789c1f9c0e4","sha1":"27ff8e129dea32dcc0357489602cb9b1811ba844","sha256":"442a835751a7949fb24865ac0e1d1d6861db561519b1e3b734fa069244a645ff","sha512":"fbf622c25af137eb74b9b47b957bc00d0d547091aa8555c611e140e27b8400cd5fd8bbdfadfed41163876f0f46f06d9abb4324e05a8983be6aefc980978d1b1b","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"dwm.exe (PID: 1496)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=6ebe07fbd9e1f5db9cc2a63b7d6141a63caf38d93a56bb8f86499802cab15f7ef096b3f2c9b75c3966ebf5fbf491770542d3952981e9df4b09004462996e338041cc78bf16","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=6ebe07fbd9e1f5db9cc2a63b7d6141a63caf38d93a56bb8f86499802cab15f7ef096b3f2c9b75c3966ebf5fbf491770542d3952981e9df4b09004462996e338041cc78bf16","has_overview":false,"extended_details":{"filename":"myoicr.pif","size":99328,"description":null,"architecture":"32 Bit","ssdeep":"1536:96bI8bGr7ew/+WpFUWG8FV2FxzsfFxLeXmFz2PcHfPWrUJp:9wI8yryw+Wpif8X4zSTLz22PUU3","imphash":"46646950e38cdd1519d35c0c539d2b12","authentihash":"8e55ad6d3d5667718e5a82dd47a05ad2d6213c2dba76de58fc6020dc6daa0c6c","entrypoint_bytes":null,"packer":"Safeguard v1.03 -> Simonzh","version_info":[],"file_sections":[{"name":".text","entropy":7.98415077098,"virtual_address":"0x1000","virtual_size":"0x11000","raw_size":"0x10200","md5":"6d7a96ab68f3fd96c8205b11111af610"}],"file_imports":[{"module":"KERNEL32.dll","functions":["ExitProcess","SetErrorMode","Sleep"]}],"file_exports":[]}},{"name":"autorun.inf","file_path":"Z:\\autorun.inf","file_size":286,"md5":"aaa7fcff6785809d972c95396e28dc1e","sha1":"fcf0574424eefcb6ba6c3e1c4520c5cf5d6cde1a","sha256":"69368e9010c172a71ca50719a030ec70687d443398ce398d6e290f99ebe4eb93","sha512":"12107df8e386180e0021f48a8d96fafc8aaec09707581e76d973bf9a298e47aa4ade6be3da62f4d1a9869a5dfccc543b2b5a493459eb1441c290ec0e971aca0f","type_tags":["text"],"description":"Microsoft Windows Autorun file, ASCII text, with CRLF line terminators","runtime_process":"dwm.exe (PID: 1496)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5dc2e02f0288384a2de46612/download/dropped-file?key=c1a7db33dec20d75663e64d65cf949936d60f81b9cd671927b97e5f8a3eca9f24c63a4e8020d7b085d654ab3575aec092a22e0b65436712c3d10bdf6110ee3691fd46f9ea2","submit_link":"/bff/report/5dc2e02f0288384a2de46612/submit/dropped-file?key=c1a7db33dec20d75663e64d65cf949936d60f81b9cd671927b97e5f8a3eca9f24c63a4e8020d7b085d654ab3575aec092a22e0b65436712c3d10bdf6110ee3691fd46f9ea2","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":["1 .CPP Files compiled with CL.EXE 13.00 (Visual Studio .NET 2002, Standard Edition) (build: 8168)","3 .OBJ Files (COFF) linked with LINK.EXE 5.12 (Visual Studio 5 SP2) (build: 8034)"],"imported_objects":[],"file_analysis":["File contains C++ code","File appears to contain raw COFF/OMF content","File is the product of a small codebase (1 files)"],"total_file_compositions_imports":3},"processes":[{"uid":"00016532-00001892","parentuid":null,"name":"kithj.pif.exe","normalized_path":"C:\\kithj.pif.exe","command_line":null,"sha256":"37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4","av_label":"Trojan.SalityStub","av_matched":62,"av_total":70,"pid":"1892","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"62/70"}]},{"uid":"00016669-00001420","parentuid":"00016532-00001892","name":"taskhost.exe","normalized_path":"%WINDIR%\\System32\\taskhost.exe","command_line":null,"sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1420","icon":null,"process_flags":[]},{"uid":"00016670-00001496","parentuid":"00016532-00001892","name":"dwm.exe","normalized_path":"%WINDIR%\\System32\\dwm.exe","command_line":null,"sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1496","icon":null,"process_flags":[{"name":"Network Activity","data":null}]},{"uid":"00019285-00003736","parentuid":"00016670-00001496","name":"rundll32.exe","normalized_path":"%WINDIR%\\System32\\rundll32.exe","command_line":"%WINDIR%\\System32\\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 \"%WINDIR%\\system32\\dwm.exe\"","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","av_label":null,"av_matched":0,"av_total":69,"pid":"3736","icon":null,"process_flags":[]},{"uid":"00016671-00001552","parentuid":"00016532-00001892","name":"explorer.exe","normalized_path":"%WINDIR%\\explorer.exe","command_line":null,"sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1552","icon":null,"process_flags":[]},{"uid":"00016673-00001756","parentuid":"00016532-00001892","name":"conhost.exe","normalized_path":"%WINDIR%\\System32\\conhost.exe","command_line":"\"-75515665917339987071872715972773993742885093597-1120896068-1005361927836486839","sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1756","icon":null,"process_flags":[]},{"uid":"00016673-00001692","parentuid":"00016532-00001892","name":"conhost.exe","normalized_path":"%WINDIR%\\System32\\conhost.exe","command_line":"\"-1902694056-1720301973548080305-513234449-830874563188854578815826590031504713530","sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1692","icon":null,"process_flags":[]},{"uid":"00016678-00001720","parentuid":"00016532-00001892","name":"conhost.exe","normalized_path":"%WINDIR%\\System32\\conhost.exe","command_line":"\"-836083514844431552836792901350554134868654435455801634-1632371152-287456975","sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"1720","icon":null,"process_flags":[]},{"uid":"00017341-00002848","parentuid":"00016532-00001892","name":"rundll32.exe","normalized_path":"%WINDIR%\\System32\\rundll32.exe","command_line":"%WINDIR%\\System32\\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 \"C:\\kithj.pif.exe\"","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","av_label":null,"av_matched":0,"av_total":69,"pid":"2848","icon":null,"process_flags":[]}],"mitre_attcks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attck_id":"T1091","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1091","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attck_id":"T1060","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies auto-execute functionality by setting/creating a value in the registry"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":5,"malicious_identifiers":["Writes data to a remote process","Injects into explorer","Injects into remote processes","Allocates virtual memory in a remote process"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":5,"malicious_identifiers":["Writes data to a remote process","Injects into explorer","Injects into remote processes","Allocates virtual memory in a remote process"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","malicious_identifiers_count":3,"malicious_identifiers":["Modifies the UAC/LUA settings (Account Control)","Modifies firewall settings"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":1,"informative_identifiers":["Creates or modifies windows services"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Marks file for deletion"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1045","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":null},{"tactic":"Credential Access","technique":"Replication Through Removable Media","attck_id":"T1091","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1091","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":5,"suspicious_identifiers":["Reads the cryptographic machine GUID","Queries sensitive IE security settings","Reads the active computer name"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","malicious_identifiers_count":1,"malicious_identifiers":["Tries to access unusual system drive letters"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1063","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Scanning for window names"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1076","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads terminal service related keys (often RDP related)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Lateral Movement","technique":"Replication Through Removable Media","attck_id":"T1091","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1091","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Commonly Used Port","attck_id":"T1043","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1043","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Sends UDP traffic"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"paaaaad.fd.fd\"\n \"padrup.com.ds\"","description_v2":["\"paaaaad.fd.fd\"","\"padrup.com.ds\""],"description_v3":[{"type":"text","value":"\"paaaaad.fd.fd\""},{"type":"linebreak"},{"type":"text","value":"\"padrup.com.ds\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"118.136.16.138:5614\"\n \"180.247.53.107:7866\"\n \"86.107.231.10:7534\"\n \"93.114.69.232:5684\"\n \"220.247.166.100:4492\"\n \"202.177.246.59:6715\"\n \"189.122.188.39:7538\"\n \"89.38.237.65:5064\"\n \"188.215.25.69:6310\"\n \"14.96.75.194:6130\"\n \"212.76.78.10:6260\"\n \"14.98.120.25:6740\"\n \"112.204.145.248:5300\"\n \"200.8.145.17:6780\"","description_v2":["\"118.136.16.138:5614\"","\"180.247.53.107:7866\"","\"86.107.231.10:7534\"","\"93.114.69.232:5684\"","\"220.247.166.100:4492\"","\"202.177.246.59:6715\"","\"189.122.188.39:7538\"","\"89.38.237.65:5064\"","\"188.215.25.69:6310\"","\"14.96.75.194:6130\"","\"212.76.78.10:6260\"","\"14.98.120.25:6740\"","\"112.204.145.248:5300\"","\"200.8.145.17:6780\""],"description_v3":[{"type":"text","value":"\"118.136.16.138:5614\""},{"type":"linebreak"},{"type":"text","value":"\"180.247.53.107:7866\""},{"type":"linebreak"},{"type":"text","value":"\"86.107.231.10:7534\""},{"type":"linebreak"},{"type":"text","value":"\"93.114.69.232:5684\""},{"type":"linebreak"},{"type":"text","value":"\"220.247.166.100:4492\""},{"type":"linebreak"},{"type":"text","value":"\"202.177.246.59:6715\""},{"type":"linebreak"},{"type":"text","value":"\"189.122.188.39:7538\""},{"type":"linebreak"},{"type":"text","value":"\"89.38.237.65:5064\""},{"type":"linebreak"},{"type":"text","value":"\"188.215.25.69:6310\""},{"type":"linebreak"},{"type":"text","value":"\"14.96.75.194:6130\""},{"type":"linebreak"},{"type":"text","value":"\"212.76.78.10:6260\""},{"type":"linebreak"},{"type":"text","value":"\"14.98.120.25:6740\""},{"type":"linebreak"},{"type":"text","value":"\"112.204.145.248:5300\""},{"type":"linebreak"},{"type":"text","value":"\"200.8.145.17:6780\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-4","type":6,"relevance":1,"name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\xpvyj.exe\"\n \".exe\" created file \"%TEMP%\\winoqug.exe\"\n \"dwm.exe\" created file \"%TEMP%\\tdnjxj.exe\"\n \"dwm.exe\" created file \"%TEMP%\\winxycyvb.exe\"","description_v2":["\".exe\" created file \"%TEMP%\\xpvyj.exe\"","\".exe\" created file \"%TEMP%\\winoqug.exe\"","\"dwm.exe\" created file \"%TEMP%\\tdnjxj.exe\"","\"dwm.exe\" created file \"%TEMP%\\winxycyvb.exe\""],"description_v3":[{"type":"text","value":"\".exe\" created file \"%TEMP%\\xpvyj.exe\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" created file \"%TEMP%\\winoqug.exe\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" created file \"%TEMP%\\tdnjxj.exe\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" created file \"%TEMP%\\winxycyvb.exe\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\uxJLpe1m\"\n \"wmiprvse.exeM_576_\"\n \"svchost.exeM_2448_\"\n \"services.exeM_436_\"\n \"svchost.exeM_928_\"\n \"svchost.exeM_828_\"\n \"wmiprvse.exeM_2676_\"\n \"svchost.exeM_904_\"\n \"conhost.exeM_1720_\"\n \"smss.exeM_264_\"\n \"svchost.exeM_1012_\"\n \"svchost.exeM_1200_\"\n \"taskhost.exeM_1420_\"\n \"csrss.exeM_388_\"\n \"wmiadap.exeM_1324_\"\n \"taskhost.exeM_3212_\"\n \"svchost.exeM_740_\"\n \"lsass.exeM_480_\"\n \"explorer.exeM_1552_\"\n \"rundll32.exeM_2848_\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\uxJLpe1m\"","\"wmiprvse.exeM_576_\"","\"svchost.exeM_2448_\"","\"services.exeM_436_\"","\"svchost.exeM_928_\"","\"svchost.exeM_828_\"","\"wmiprvse.exeM_2676_\"","\"svchost.exeM_904_\"","\"conhost.exeM_1720_\"","\"smss.exeM_264_\"","\"svchost.exeM_1012_\"","\"svchost.exeM_1200_\"","\"taskhost.exeM_1420_\"","\"csrss.exeM_388_\"","\"wmiadap.exeM_1324_\"","\"taskhost.exeM_3212_\"","\"svchost.exeM_740_\"","\"lsass.exeM_480_\"","\"explorer.exeM_1552_\"","\"rundll32.exeM_2848_\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\uxJLpe1m\""},{"type":"linebreak"},{"type":"text","value":"\"wmiprvse.exeM_576_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_2448_\""},{"type":"linebreak"},{"type":"text","value":"\"services.exeM_436_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_928_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_828_\""},{"type":"linebreak"},{"type":"text","value":"\"wmiprvse.exeM_2676_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_904_\""},{"type":"linebreak"},{"type":"text","value":"\"conhost.exeM_1720_\""},{"type":"linebreak"},{"type":"text","value":"\"smss.exeM_264_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_1012_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_1200_\""},{"type":"linebreak"},{"type":"text","value":"\"taskhost.exeM_1420_\""},{"type":"linebreak"},{"type":"text","value":"\"csrss.exeM_388_\""},{"type":"linebreak"},{"type":"text","value":"\"wmiadap.exeM_1324_\""},{"type":"linebreak"},{"type":"text","value":"\"taskhost.exeM_3212_\""},{"type":"linebreak"},{"type":"text","value":"\"svchost.exeM_740_\""},{"type":"linebreak"},{"type":"text","value":"\"lsass.exeM_480_\""},{"type":"linebreak"},{"type":"text","value":"\"explorer.exeM_1552_\""},{"type":"linebreak"},{"type":"text","value":"\"rundll32.exeM_2848_\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$26","description_v2":["\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","\".exe\" touched \"CLSID_ExecuteFolder\" (Path: \"HKCU\\CLSID\\{11DBB47C-A525-400B-9E80-A54615A090C0}\\INPROCSERVER32\")","\".exe\" touched \"ShellWindows\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\")","\".exe\" touched \"PSOAInterface\" (Path: \"HKCU\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")","\".exe\" touched \"PSDispatch\" (Path: \"HKCU\\CLSID\\{00020420-0000-0000-C000-000000000046}\\TREATAS\")","\".exe\" touched \"CLSID_DesktopExplorerHost\" (Path: \"HKCU\\CLSID\\{682159D9-C321-47CA-B3F1-30E36B2EC8B9}\\TREATAS\")","\".exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\TREATAS\")","\"dwm.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")","\"dwm.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")","\"dwm.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"CLSID_ExecuteFolder\" (Path: \"HKCU\\CLSID\\{11DBB47C-A525-400B-9E80-A54615A090C0}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"ShellWindows\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"PSOAInterface\" (Path: \"HKCU\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"PSDispatch\" (Path: \"HKCU\\CLSID\\{00020420-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"CLSID_DesktopExplorerHost\" (Path: \"HKCU\\CLSID\\{682159D9-C321-47CA-B3F1-30E36B2EC8B9}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\TREATAS\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"$27","description_v2":["Process \"explorer.exe\" (UID: 00016671-00001552) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"","Process \"explorer.exe\" (UID: 00016671-00001552) was launched with modified environment variables: \"Path\"","Process \"conhost.exe\" (UID: 00016673-00001692) was launched with modified environment variables: \"Path, TEMP, TMP, USERNAME\"","Process \"conhost.exe\" (UID: 00016673-00001692) was launched with missing environment variables: \"LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC\"","Process \"rundll32.exe\" (UID: 00017341-00002848) was launched with new environment variables: \"LOCALAPPDATA=\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\", COMPUTERNAME=\"H6FnFQnUZB\", USERDOMAIN=\"H6FnFQnUZB\", ALLUSERSPROFILE=\"C:\\ProgramData\", ProgramData=\"C:\\ProgramData\", APPDATA=\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\", USERPROFILE=\"C:\\Windows\\ServiceProfiles\\LocalService\", PUBLIC=\"C:\\Users\\Public\"\"","Process \"rundll32.exe\" (UID: 00017341-00002848) was launched with modified environment variables: \"TEMP, TMP, USERNAME\""],"description_v3":[{"type":"text","value":"Process \"explorer.exe\""},{"type":"process","process_uid":"00016671-00001552","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"SESSIONNAME=\"Console\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"explorer.exe\""},{"type":"process","process_uid":"00016671-00001552","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"Path\""},{"type":"linebreak"},{"type":"text","value":"Process \"conhost.exe\""},{"type":"process","process_uid":"00016673-00001692","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"Path, TEMP, TMP, USERNAME\""},{"type":"linebreak"},{"type":"text","value":"Process \"conhost.exe\""},{"type":"process","process_uid":"00016673-00001692","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC\""},{"type":"linebreak"},{"type":"text","value":"Process \"rundll32.exe\""},{"type":"process","process_uid":"00017341-00002848","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"LOCALAPPDATA=\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\", COMPUTERNAME=\"H6FnFQnUZB\", USERDOMAIN=\"H6FnFQnUZB\", ALLUSERSPROFILE=\"%ALLUSERSPROFILE%\\, ProgramData=\"C:\\ProgramData\", APPDATA=\"C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\", USERPROFILE=\"C:\\Windows\\ServiceProfiles\\LocalService\", PUBLIC=\"C:\\Users\\Public\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"rundll32.exe\""},{"type":"process","process_uid":"00017341-00002848","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"TEMP, TMP, USERNAME\""}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"explorer.exe\" searching for class \"Shell_TrayWnd\"","description_v2":["\"explorer.exe\" searching for class \"Shell_TrayWnd\""],"description_v3":[{"type":"text","value":"\"explorer.exe\" searching for class \"Shell_TrayWnd\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\".exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\".exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"autorun.inf\" has type \"Microsoft Windows Autorun file ASCII text with CRLF line terminators\"\n \"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","description_v2":["\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"autorun.inf\" has type \"Microsoft Windows Autorun file ASCII text with CRLF line terminators\"","\"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""],"description_v3":[{"type":"text","value":"\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"autorun.inf\" has type \"Microsoft Windows Autorun file ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\".exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\".exe\" touched file \"C:\\Windows\\3ae6eb\"","\".exe\" touched file \"C:\\Windows\\mkwsklc.log\"","\".exe\" touched file \"C:\\Windows\\system.ini\"","\".exe\" touched file \"C:\\Windows\\System32\\rsaenh.dll\"","\".exe\" touched file \"C:\\Users\\Rs76WHR\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"","\".exe\" touched file \"C:\\Windows\\System32\\ieframe.dll\"","\".exe\" touched file \"C:\\Windows\\System32\\stdole2.tlb\"","\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"","\".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Libraries\\desktop.ini\"","\".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini\"","\"taskhost.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\container.dat\"","\"taskhost.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\container.dat\"","\"dwm.exe\" touched file \"C:\\Windows\\46fae\"","\"dwm.exe\" touched file \"C:\\Windows\\mkwsklc.log\""],"description_v3":[{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\3ae6eb\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\mkwsklc.log\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\system.ini\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\System32\\rsaenh.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\System32\\ieframe.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"C:\\Windows\\System32\\stdole2.tlb\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Libraries\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"taskhost.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\container.dat\""},{"type":"linebreak"},{"type":"text","value":"\"taskhost.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\container.dat\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched file \"C:\\Windows\\46fae\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched file \"C:\\Windows\\mkwsklc.log\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"Pattern match: \"http://padrup.com.ds/sobaka1.gif\"\n Pattern match: \"http://paaaaad.fd.fd/sobakavolos.gif\"\n Heuristic match: \"WMP11.AssocFile.AU\"","description_v2":["Pattern match: \"http://padrup.com.ds/sobaka1.gif\"","Pattern match: \"http://paaaaad.fd.fd/sobakavolos.gif\"","Heuristic match: \"WMP11.AssocFile.AU\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://padrup.com.ds/sobaka1.gif\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://paaaaad.fd.fd/sobakavolos.gif\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"WMP11.AssocFile.AU\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"$29","description_v2":["\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")","\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")","\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")","\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")","\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")","\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")","\"dwm.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")"],"description_v3":[{"type":"text","value":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"dwm.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\".exe\" opened \"\\Device\\KsecDD\"","\"dwm.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\".exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"kithj.pif.bin\" was detected as \"Safeguard v1.03 -> Simonzh\"\n \"myoicr.pif\" was detected as \"Safeguard v1.03 -> Simonzh\"","description_v2":["\"kithj.pif.bin\" was detected as \"Safeguard v1.03 -> Simonzh\"","\"myoicr.pif\" was detected as \"Safeguard v1.03 -> Simonzh\""],"description_v3":[{"type":"text","value":"\"kithj.pif.bin\" was detected as \"Safeguard v1.03 -> Simonzh\""},{"type":"linebreak"},{"type":"text","value":"\"myoicr.pif\" was detected as \"Safeguard v1.03 -> Simonzh\""}],"origin":"Static Parser","attck_id":"T1045","capec_id":"CAPEC-570","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":10,"name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.98455496362\n 7.98415077098","description_v2":[".text",".text with unusual entropies 7.98455496362","7.98415077098"],"description_v3":[{"type":"text","value":".text"},{"type":"linebreak"},{"type":"text","value":".text with unusual entropies 7.98455496362"},{"type":"linebreak"},{"type":"text","value":"7.98415077098"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-24","type":6,"relevance":10,"name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \".exe\" sleeping for \"00120000\" milliseconds\n \".exe\" sleeping for \"00180000\" milliseconds\n \".exe\" sleeping for \"00300000\" milliseconds\n \".exe\" sleeping for \"00600000\" milliseconds\n \"taskhost.exe\" sleeping for \"1566804069\" milliseconds","description_v2":["\".exe\" sleeping for \"1566804069\" milliseconds","\".exe\" sleeping for \"00120000\" milliseconds","\".exe\" sleeping for \"00180000\" milliseconds","\".exe\" sleeping for \"00300000\" milliseconds","\".exe\" sleeping for \"00600000\" milliseconds","\"taskhost.exe\" sleeping for \"1566804069\" milliseconds"],"description_v3":[{"type":"text","value":"\".exe\" sleeping for \"1566804069\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\".exe\" sleeping for \"00120000\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\".exe\" sleeping for \"00180000\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\".exe\" sleeping for \"00300000\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\".exe\" sleeping for \"00600000\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\"taskhost.exe\" sleeping for \"1566804069\" milliseconds"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-6","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"6/71 reputation engines marked \"http://padrup.com\" as malicious (8% detection rate)","description_v2":["6/71 reputation engines marked \"http://padrup.com\" as malicious (8% detection rate)"],"description_v3":[{"type":"text","value":"6/71 reputation engines marked \"http://padrup.com\" as malicious (8% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\".exe\" read file \"%WINDIR%\\system.ini\"\n \".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"dwm.exe\" read file \"%WINDIR%\\system.ini\"","description_v2":["\".exe\" read file \"%WINDIR%\\system.ini\"","\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","\"dwm.exe\" read file \"%WINDIR%\\system.ini\""],"description_v3":[{"type":"text","value":"\".exe\" read file \"%WINDIR%\\system.ini\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" read file \"%WINDIR%\\system.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"network-5","type":7,"relevance":7,"name":"Sends UDP traffic","description":"\"UDP connection to 118.136.16.138\"\n \"UDP connection to 180.247.53.107\"\n \"UDP connection to 86.107.231.10\"\n \"UDP connection to 93.114.69.232\"\n \"UDP connection to 220.247.166.100\"\n \"UDP connection to 202.177.246.59\"\n \"UDP connection to 189.122.188.39\"\n \"UDP connection to 89.38.237.65\"\n \"UDP connection to 188.215.25.69\"\n \"UDP connection to 14.96.75.194\"\n \"UDP connection to 212.76.78.10\"\n \"UDP connection to 14.98.120.25\"\n \"UDP connection to 112.204.145.248\"\n \"UDP connection to 200.8.145.17\"","description_v2":["\"UDP connection to 118.136.16.138\"","\"UDP connection to 180.247.53.107\"","\"UDP connection to 86.107.231.10\"","\"UDP connection to 93.114.69.232\"","\"UDP connection to 220.247.166.100\"","\"UDP connection to 202.177.246.59\"","\"UDP connection to 189.122.188.39\"","\"UDP connection to 89.38.237.65\"","\"UDP connection to 188.215.25.69\"","\"UDP connection to 14.96.75.194\"","\"UDP connection to 212.76.78.10\"","\"UDP connection to 14.98.120.25\"","\"UDP connection to 112.204.145.248\"","\"UDP connection to 200.8.145.17\""],"description_v3":[{"type":"text","value":"\"UDP connection to 118.136.16.138\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 180.247.53.107\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 86.107.231.10\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 93.114.69.232\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 220.247.166.100\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 202.177.246.59\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 189.122.188.39\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 89.38.237.65\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 188.215.25.69\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 14.96.75.194\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 212.76.78.10\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 14.98.120.25\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 112.204.145.248\""},{"type":"linebreak"},{"type":"text","value":"\"UDP connection to 200.8.145.17\""}],"origin":"Network Traffic","attck_id":"T1043","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1043","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","description_v2":["\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""],"description_v3":[{"type":"text","value":"\"winoqug.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"myoicr.pif\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"winxycyvb.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"xpvyj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"tdnjxj.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"registry-0","type":3,"relevance":8,"name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\"; Key: \"LOCKED\"; Value: \"01000000\")","description_v2":["\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\"; Key: \"LOCKED\"; Value: \"01000000\")"],"description_v3":[{"type":"text","value":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\"; Key: \"LOCKED\"; Value: \"01000000\")"}],"origin":"Registry Access","attck_id":"T1060","capec_id":"CAPEC-270","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-6","type":7,"relevance":5,"name":"Contacts Random Domain Names","description":"\"padrup.com.ds\" seems to be random","description_v2":["\"padrup.com.ds\" seems to be random"],"description_v3":[{"type":"text","value":"\"padrup.com.ds\" seems to be random"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-36","type":7,"relevance":10,"name":"Process binds to unusual ports","description":"Process \"C:\\kithj.pif.exe\" binds to port 5812\n Process \"C:\\kithj.pif.exe\" binds to port 5831\n Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5903\n Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5884","description_v2":["Process \"C:\\kithj.pif.exe\" binds to port 5812","Process \"C:\\kithj.pif.exe\" binds to port 5831","Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5903","Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5884"],"description_v3":[{"type":"text","value":"Process \"C:\\kithj.pif.exe\" binds to port 5812"},{"type":"linebreak"},{"type":"text","value":"Process \"C:\\kithj.pif.exe\" binds to port 5831"},{"type":"linebreak"},{"type":"text","value":"Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5903"},{"type":"linebreak"},{"type":"text","value":"Process \"%WINDIR%\\System32\\dwm.exe\" binds to port 5884"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"registry-61","type":3,"relevance":10,"name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","description_v2":["\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"}],"origin":"Registry Access","attck_id":"T1076","capec_id":"CAPEC-555","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-26","type":6,"relevance":10,"name":"Marks file for deletion","description":"\"C:\\kithj.pif.exe\" marked \"%WINDIR%\\3ae6eb\" for deletion\n \"C:\\kithj.pif.exe\" marked \"%TEMP%\\xpvyj.exe\" for deletion\n \"C:\\kithj.pif.exe\" marked \"%TEMP%\\winoqug.exe\" for deletion\n \"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\tdnjxj.exe\" for deletion\n \"%WINDIR%\\System32\\dwm.exe\" marked \"%WINDIR%\\46fae\" for deletion\n \"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\winxycyvb.exe\" for deletion","description_v2":["\"C:\\kithj.pif.exe\" marked \"%WINDIR%\\3ae6eb\" for deletion","\"C:\\kithj.pif.exe\" marked \"%TEMP%\\xpvyj.exe\" for deletion","\"C:\\kithj.pif.exe\" marked \"%TEMP%\\winoqug.exe\" for deletion","\"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\tdnjxj.exe\" for deletion","\"%WINDIR%\\System32\\dwm.exe\" marked \"%WINDIR%\\46fae\" for deletion","\"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\winxycyvb.exe\" for deletion"],"description_v3":[{"type":"text","value":"\"C:\\kithj.pif.exe\" marked \"%WINDIR%\\3ae6eb\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\kithj.pif.exe\" marked \"%TEMP%\\xpvyj.exe\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\kithj.pif.exe\" marked \"%TEMP%\\winoqug.exe\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\tdnjxj.exe\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%WINDIR%\\System32\\dwm.exe\" marked \"%WINDIR%\\46fae\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%WINDIR%\\System32\\dwm.exe\" marked \"%TEMP%\\winxycyvb.exe\" for deletion"}],"origin":"API Call","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\3ae6eb\" with delete access\n \".exe\" opened \"%TEMP%\\xpvyj.exe\" with delete access\n \".exe\" opened \"%TEMP%\\winoqug.exe\" with delete access\n \"dwm.exe\" opened \"%TEMP%\\tdnjxj.exe\" with delete access\n \"dwm.exe\" opened \"%WINDIR%\\46fae\" with delete access\n \"dwm.exe\" opened \"%TEMP%\\winxycyvb.exe\" with delete access","description_v2":["\".exe\" opened \"%WINDIR%\\3ae6eb\" with delete access","\".exe\" opened \"%TEMP%\\xpvyj.exe\" with delete access","\".exe\" opened \"%TEMP%\\winoqug.exe\" with delete access","\"dwm.exe\" opened \"%TEMP%\\tdnjxj.exe\" with delete access","\"dwm.exe\" opened \"%WINDIR%\\46fae\" with delete access","\"dwm.exe\" opened \"%TEMP%\\winxycyvb.exe\" with delete access"],"description_v3":[{"type":"text","value":"\".exe\" opened \"%WINDIR%\\3ae6eb\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\".exe\" opened \"%TEMP%\\xpvyj.exe\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\".exe\" opened \"%TEMP%\\winoqug.exe\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" opened \"%TEMP%\\tdnjxj.exe\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" opened \"%WINDIR%\\46fae\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" opened \"%TEMP%\\winxycyvb.exe\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","description_v2":["\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")","\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")","\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"dwm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"dwm.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"dwm.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"dwm.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"Sleep","description_v2":["Sleep"],"description_v3":[{"type":"text","value":"Sleep"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"86c455769803567652be567600000000\" to virtual address \"0x00401000\" (part of module \"KITHJ.PIF.EXE\")\n \".exe\" wrote bytes \"fae64777e1a64c772e714c77ee294c7785e247776da04c7726e44777d16d4c77003d4a77804b4a7700000000ad3768778b2d6877b641687700000000\" to virtual address \"0x74801000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"c04e4a7720544b77e0654b77b5384c770000000000d0557600000000c5ea55760000000088ea557600000000e968657582284c77ee294c7700000000d2696575000000007dbb55760000000009be657500000000ba18557600000000\" to virtual address \"0x75F41000\" (part of module \"NSI.DLL\")","description_v2":["\".exe\" wrote bytes \"86c455769803567652be567600000000\" to virtual address \"0x00401000\" (part of module \"KITHJ.PIF.EXE\")","\".exe\" wrote bytes \"fae64777e1a64c772e714c77ee294c7785e247776da04c7726e44777d16d4c77003d4a77804b4a7700000000ad3768778b2d6877b641687700000000\" to virtual address \"0x74801000\" (part of module \"WSHTCPIP.DLL\")","\".exe\" wrote bytes \"c04e4a7720544b77e0654b77b5384c770000000000d0557600000000c5ea55760000000088ea557600000000e968657582284c77ee294c7700000000d2696575000000007dbb55760000000009be657500000000ba18557600000000\" to virtual address \"0x75F41000\" (part of module \"NSI.DLL\")"],"description_v3":[{"type":"text","value":"\".exe\" wrote bytes \"86c455769803567652be567600000000\" to virtual address \"0x00401000\" (part of module \"KITHJ.PIF.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote bytes \"fae64777e1a64c772e714c77ee294c7785e247776da04c7726e44777d16d4c77003d4a77804b4a7700000000ad3768778b2d6877b641687700000000\" to virtual address \"0x74801000\" (part of module \"WSHTCPIP.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote bytes \"c04e4a7720544b77e0654b77b5384c770000000000d0557600000000c5ea55760000000088ea557600000000e968657582284c77ee294c7700000000d2696575000000007dbb55760000000009be657500000000ba18557600000000\" to virtual address \"0x75F41000\" (part of module \"NSI.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-3","type":12,"relevance":10,"name":"Sample was identified as malicious by a large number of Antivirus engines","description":"62/70 Antivirus vendors marked sample as malicious (88% detection rate)","description_v2":["62/70 Antivirus vendors marked sample as malicious (88% detection rate)"],"description_v3":[{"type":"text","value":"62/70 Antivirus vendors marked sample as malicious (88% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":8,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"62/70 Antivirus vendors marked sample as malicious (88% detection rate)","description_v2":["62/70 Antivirus vendors marked sample as malicious (88% detection rate)"],"description_v3":[{"type":"text","value":"62/70 Antivirus vendors marked sample as malicious (88% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"binary-11","type":8,"relevance":10,"name":"The analysis extracted a file that was identified as malicious","description":"63/74 Antivirus vendors marked dropped file \"winoqug.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)\n 63/74 Antivirus vendors marked dropped file \"winxycyvb.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)\n 63/74 Antivirus vendors marked dropped file \"xpvyj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)\n 63/74 Antivirus vendors marked dropped file \"tdnjxj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)","description_v2":["63/74 Antivirus vendors marked dropped file \"winoqug.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)","63/74 Antivirus vendors marked dropped file \"winxycyvb.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)","63/74 Antivirus vendors marked dropped file \"xpvyj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)","63/74 Antivirus vendors marked dropped file \"tdnjxj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)"],"description_v3":[{"type":"text","value":"63/74 Antivirus vendors marked dropped file \"winoqug.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)"},{"type":"linebreak"},{"type":"text","value":"63/74 Antivirus vendors marked dropped file \"winxycyvb.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)"},{"type":"linebreak"},{"type":"text","value":"63/74 Antivirus vendors marked dropped file \"xpvyj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)"},{"type":"linebreak"},{"type":"text","value":"63/74 Antivirus vendors marked dropped file \"tdnjxj.exe\" as malicious (classified as \"Trojan.Small\" with 85% detection rate)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-20","type":6,"relevance":7,"name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\"\n \".exe\" allocated memory in \"%WINDIR%\\System32\\ntmarta.dll\"\n \".exe\" allocated memory in \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2092356043-4041700817-663127204-1001\"\n \".exe\" allocated memory in \"C:\\share\"\n \".exe\" allocated memory in \"%WINDIR%\\System32\\dui70.dll\"","description_v2":["\".exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\"","\".exe\" allocated memory in \"%WINDIR%\\System32\\ntmarta.dll\"","\".exe\" allocated memory in \"%USERPROFILE%\\Desktop\\desktop.ini\"","\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2092356043-4041700817-663127204-1001\"","\".exe\" allocated memory in \"C:\\share\"","\".exe\" allocated memory in \"%WINDIR%\\System32\\dui70.dll\""],"description_v3":[{"type":"text","value":"\".exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" allocated memory in \"%WINDIR%\\System32\\ntmarta.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" allocated memory in \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2092356043-4041700817-663127204-1001\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" allocated memory in \"C:\\share\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" allocated memory in \"%WINDIR%\\System32\\dui70.dll\""}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"target-20","type":9,"relevance":5,"name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00016671-00001552)","description_v2":["Injected into \"explorer.exe\" (UID: 00016671-00001552)"],"description_v3":[{"type":"text","value":"Injected into \"explorer.exe\""},{"type":"process","process_uid":"00016671-00001552","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"target-0","type":9,"relevance":6,"name":"Injects into remote processes","description":"Injected into \"taskhost.exe\" at 2019-11-9.18:24:26.111 (UID: 00016669-00001420)\n Injected into \"dwm.exe\" at 2019-11-9.18:24:26.127 (UID: 00016670-00001496)\n Injected into \"explorer.exe\" at 2019-11-9.18:24:26.143 (UID: 00016671-00001552)\n Injected into \"conhost.exe\" at 2019-11-9.18:24:26.252 (UID: 00016673-00001756)\n Injected into \"conhost.exe\" at 2019-11-9.18:24:26.174 (UID: 00016673-00001692)\n Injected into \"conhost.exe\" at 2019-11-9.18:24:26.268 (UID: 00016678-00001720)\n Injected into \"rundll32.exe\" at 2019-11-9.18:35:40.527 (UID: 00017341-00002848)\n Injected into \"rundll32.exe\" at 2019-11-9.18:46:20.464 (UID: 00019285-00003736)","description_v2":["Injected into \"taskhost.exe\" at 2019-11-9.18:24:26.111 (UID: 00016669-00001420)","Injected into \"dwm.exe\" at 2019-11-9.18:24:26.127 (UID: 00016670-00001496)","Injected into \"explorer.exe\" at 2019-11-9.18:24:26.143 (UID: 00016671-00001552)","Injected into \"conhost.exe\" at 2019-11-9.18:24:26.252 (UID: 00016673-00001756)","Injected into \"conhost.exe\" at 2019-11-9.18:24:26.174 (UID: 00016673-00001692)","Injected into \"conhost.exe\" at 2019-11-9.18:24:26.268 (UID: 00016678-00001720)","Injected into \"rundll32.exe\" at 2019-11-9.18:35:40.527 (UID: 00017341-00002848)","Injected into \"rundll32.exe\" at 2019-11-9.18:46:20.464 (UID: 00019285-00003736)"],"description_v3":[{"type":"text","value":"Injected into \"taskhost.exe\" at 2019-11-9.18:24:26.111"},{"type":"process","process_uid":"00016669-00001420","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"dwm.exe\" at 2019-11-9.18:24:26.127"},{"type":"process","process_uid":"00016670-00001496","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"explorer.exe\" at 2019-11-9.18:24:26.143"},{"type":"process","process_uid":"00016671-00001552","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"conhost.exe\" at 2019-11-9.18:24:26.252"},{"type":"process","process_uid":"00016673-00001756","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"conhost.exe\" at 2019-11-9.18:24:26.174"},{"type":"process","process_uid":"00016673-00001692","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"conhost.exe\" at 2019-11-9.18:24:26.268"},{"type":"process","process_uid":"00016678-00001720","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"rundll32.exe\" at 2019-11-9.18:35:40.527"},{"type":"process","process_uid":"00017341-00002848","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Injected into \"rundll32.exe\" at 2019-11-9.18:46:20.464"},{"type":"process","process_uid":"00019285-00003736","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$2a","description_v2":["\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\taskhost.exe\" (Handle: 516)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\taskhost.exe\" (Handle: 516)","\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\dwm.exe\" (Handle: 556)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\dwm.exe\" (Handle: 556)","\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 584)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 584)","\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 640)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 640)","\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 644)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 644)","\".exe\" wrote 8192 bytes to a remote process \"C:\\kithj.pif.exe\" (Handle: 716)","\".exe\" wrote 4096 bytes to a remote process \"C:\\kithj.pif.exe\" (Handle: 716)","\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 744)","\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 744)","\"dwm.exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 672)","\"dwm.exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 672)"],"description_v3":[{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"%WINDIR%\\System32\\taskhost.exe\" (Handle: 516)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\taskhost.exe\" (Handle: 516)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\dwm.exe\" (Handle: 556)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\dwm.exe\" (Handle: 556)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 640)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 640)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 644)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\conhost.exe\" (Handle: 644)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\kithj.pif.exe\" (Handle: 716)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\kithj.pif.exe\" (Handle: 716)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 744)"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 744)"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" wrote 8192 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 672)"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" wrote 4096 bytes to a remote process \"C:\\Windows\\System32\\rundll32.exe\" (Handle: 672)"}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-17","type":7,"relevance":9,"name":"Contacts very many different hosts","description":"Contacted 14 (or more) hosts in at least 10 different countries","description_v2":["Contacted 14 (or more) hosts in at least 10 different countries"],"description_v3":[{"type":"text","value":"Contacted 14 (or more) hosts in at least 10 different countries"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Security","identifier":"registry-12","type":3,"relevance":9,"name":"Modifies firewall settings","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")\n \"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")\n \"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")\n \"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")","description_v2":["\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")","\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")","\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")","\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")","\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Security","identifier":"registry-11","type":3,"relevance":8,"name":"Modifies security center notification settings","description":"$2b","description_v2":["\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"ANTIVIRUSDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"FIREWALLOVERRIDE\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\"; Key: \"UPDATESDISABLENOTIFY\"; Value: \"01000000\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Security","identifier":"registry-10","type":3,"relevance":8,"name":"Modifies the UAC/LUA settings (Account Control)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")\n \"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")\n \"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","description_v2":["\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")","\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")","\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"api-31","type":6,"relevance":9,"name":"Tries to access unusual system drive letters","description":"\".exe\" touched \"K:\"\n \".exe\" touched \"K:\\\"\n \".exe\" touched \"M:\\\"\n \".exe\" touched \"L:\"\n \".exe\" touched \"P:\"\n \".exe\" touched \"M:\"\n \".exe\" touched \"O:\\\"\n \".exe\" touched \"L:\\\"\n \".exe\" touched \"O:\"\n \".exe\" touched \"Q:\\\"\n \".exe\" touched \"U:\"\n \".exe\" touched \"Q:\"\n \".exe\" touched \"S:\\\"\n \".exe\" touched \"V:\"\n \".exe\" touched \"P:\\\"\n \".exe\" touched \"S:\"\n \".exe\" touched \"U:\\\"\n \"dwm.exe\" touched \"K:\"\n \"dwm.exe\" touched \"L:\"\n \"dwm.exe\" touched \"O:\\\"\n \"dwm.exe\" touched \"Q:\"\n \"dwm.exe\" touched \"K:\\\"\n \"dwm.exe\" touched \"M:\"\n \"dwm.exe\" touched \"L:\\\"\n \"dwm.exe\" touched \"N:\"\n \"dwm.exe\" touched \"M:\\\"\n \"dwm.exe\" touched \"O:\"","description_v2":["\".exe\" touched \"K:\"","\".exe\" touched \"K:\\\"","\".exe\" touched \"M:\\\"","\".exe\" touched \"L:\"","\".exe\" touched \"P:\"","\".exe\" touched \"M:\"","\".exe\" touched \"O:\\\"","\".exe\" touched \"L:\\\"","\".exe\" touched \"O:\"","\".exe\" touched \"Q:\\\"","\".exe\" touched \"U:\"","\".exe\" touched \"Q:\"","\".exe\" touched \"S:\\\"","\".exe\" touched \"V:\"","\".exe\" touched \"P:\\\"","\".exe\" touched \"S:\"","\".exe\" touched \"U:\\\"","\"dwm.exe\" touched \"K:\"","\"dwm.exe\" touched \"L:\"","\"dwm.exe\" touched \"O:\\\"","\"dwm.exe\" touched \"Q:\"","\"dwm.exe\" touched \"K:\\\"","\"dwm.exe\" touched \"M:\"","\"dwm.exe\" touched \"L:\\\"","\"dwm.exe\" touched \"N:\"","\"dwm.exe\" touched \"M:\\\"","\"dwm.exe\" touched \"O:\""],"description_v3":[{"type":"text","value":"\".exe\" touched \"K:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"K:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"M:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"L:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"P:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"M:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"O:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"L:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"O:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"Q:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"U:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"Q:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"S:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"V:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"P:\\\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"S:\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" touched \"U:\\\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"K:\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"L:\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"O:\\\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"Q:\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"K:\\\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"M:\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"L:\\\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"N:\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"M:\\\""},{"type":"linebreak"},{"type":"text","value":"\"dwm.exe\" touched \"O:\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":false,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Professional","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"32","custom_date_time":null,"sandbox_version":"8.30","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Remote Access","details":["Reads terminal service related keys (often RDP related)"]},{"name":"Spyware","details":["Found a string that may be used as part of an injection method"]},{"name":"Persistence","details":["Writes data to a remote process","Modifies auto-execute functionality by setting/creating a value in the registry","Injects into remote processes","Injects into explorer"]},{"name":"Fingerprint","details":["Queries kernel debugger information","Queries process information","Reads the cryptographic machine GUID","Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","Reads the active computer name","Queries sensitive IE security settings"]},{"name":"Evasive","details":["Tries to sleep for a long time (more than two minutes)","Marks file for deletion","Possibly checks for the presence of an Antivirus engine"]},{"name":"Spreading","details":["Tries to access unusual system drive letters"]},{"name":"Network Behavior","details":["Contacts 2 domains and 2 hosts"]}],"icon":"$2c","visualization":"$2d","classification":["42.7% (.EXE) Win32 Executable (generic)","19.2% (.EXE) OS/2 Executable (generic)","18.9% (.EXE) Generic Win/DOS Executable","18.9% (.EXE) DOS Executable Generic"],"dns_requests":[{"compromised":false,"domain":"paaaaad.fd.fd","address":null,"ttl":79716,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"padrup.com.ds","address":null,"ttl":5178,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]}],"contacted_hosts":[{"compromised":false,"address":"118.136.16.138","port":5614,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"Indonesia","associated_sha256s":[]},{"compromised":false,"address":"180.247.53.107","port":7866,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"Indonesia","associated_sha256s":[]},{"compromised":false,"address":"86.107.231.10","port":7534,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"Romania","associated_sha256s":[]},{"compromised":false,"address":"93.114.69.232","port":5684,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"United Kingdom","associated_sha256s":[]},{"compromised":false,"address":"220.247.166.100","port":4492,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"Bangladesh","associated_sha256s":[]},{"compromised":false,"address":"202.177.246.59","port":6715,"protocol":"UDP","associated_runtime":[{"name":"kithj.pif.exe","pid":"1892"},{"name":"dwm.exe","pid":"1496"}],"country":"India","associated_sha256s":[]},{"compromised":false,"address":"189.122.188.39","port":7538,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Brazil","associated_sha256s":[]},{"compromised":false,"address":"89.38.237.65","port":5064,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Romania","associated_sha256s":[]},{"compromised":false,"address":"188.215.25.69","port":6310,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Iran (ISLAMIC Republic Of)","associated_sha256s":[]},{"compromised":false,"address":"14.96.75.194","port":6130,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"India","associated_sha256s":[]},{"compromised":false,"address":"212.76.78.10","port":6260,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Saudi Arabia","associated_sha256s":[]},{"compromised":false,"address":"14.98.120.25","port":6740,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"India","associated_sha256s":[]},{"compromised":false,"address":"112.204.145.248","port":5300,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Philippines","associated_sha256s":[]},{"compromised":false,"address":"200.8.145.17","port":6780,"protocol":"UDP","associated_runtime":[{"name":"dwm.exe","pid":"1496"}],"country":"Venezuela","associated_sha256s":[]}],"contacted_countries":{"countries":["IDN","ROU","GBR","BGD","IND","BRA","IRN","SAU","PHL","VEN"],"coordinates":[{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"-6.2146","longitude":"106.8451"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"-7.2492","longitude":"112.7508"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"44.4528","longitude":"26.1332"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"51.5085","longitude":"-0.1257"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"24.899","longitude":"91.872"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"19.0333","longitude":"72.85"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"-22.9064","longitude":"-43.1822"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"44.4323","longitude":"26.1063"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"35.6944","longitude":"51.4215"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"19.0073","longitude":"72.8421"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"21.5424","longitude":"39.198"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"19.0073","longitude":"72.8421"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"14.6402","longitude":"121.0474"}},{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"10.1728","longitude":"-70.081"}}]},"port_infos":[{"port":5064,"description":"EPICS Channel Access Server"},{"port":6260,"description":"planet M.U.L.E."},{"port":6715,"description":"AberMUD and derivatives default port"}],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ii0xOTAyNjk0MDU2LTE3MjAzMDE5NzM1NDgwODAzMDUtNTEzMjM0NDQ5LTgzMDg3NDU2MzE4ODg1NDU3ODgxNTgyNjU5MDAzMTUwNDcxMzUzMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ii03NTUxNTY2NTkxNzMzOTk4NzA3MTg3MjcxNTk3Mjc3Mzk5Mzc0Mjg4NTA5MzU5Ny0xMTIwODk2MDY4LTEwMDUzNjE5Mjc4MzY0ODY4Mzk=","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ii04MzYwODM1MTQ4NDQ0MzE1NTI4MzY3OTI5MDEzNTA1NTQxMzQ4Njg2NTQ0MzU0NTU4MDE2MzQtMTYzMjM3MTE1Mi0yODc0NTY5NzU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XGtpdGhqLnBpZi5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"smss.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX0V4ZWN1dGVGb2xkZXIiJSAlR1VJRDoiSUV4ZWN1dGVDb21tYW5kIiUgMHhGRkZG","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxraXRoai5waWYuZXhl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx0ZG5qeGouZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW5vcXVnLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW54eWN5dmIuZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx4cHZ5ai5leGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiJVdJTkRJUiVcc3lzdGVtMzJcZHdtLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiQzpca2l0aGoucGlmLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null},{"value":"J19fXywsX19paWkt","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"K3UtZkJae0pz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"LF9fLF9fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"LScnX2khXycn","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"LTE1NjYxNTYyOTg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LTY1NjU1MjYzMg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDIwMDY4NzQ3NDcwM0EyRjJGNzA2MTY0NzI3NTcwMkU2MzZGNkQyRTY0NzMyRjczNkY2MjYxNkI2MTMxMkU2NzY5NjYwMDY4NzQ3NDcwM0EyRjJGNzA2MTYxNjE2MTYxNjQyRTY2NjQyRTY2NjQyRjczNkY2MjYxNkI2MTc2NkY2Qw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MF9fX18wX19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"MTE2MjY1NDcwMA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTFfOV9fb2w5NnM2cHJfX0ZfX2ZsZA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"MTM2RDhFODBGQzQ2QUZBRjNCNTU3NDI4MDk4QjNFQUMxRkU4ODQ2MjRGRUIzNjI0QTgyODA4NzBERkMxRjQ0RjAwRDcwQ0VEQjRDMTUyQzY0OUNBNDBEQkNFMkJGRDlEMzcxQ0MxNTg1NDU4RkI0NTAxNDU3Rjk3ODVDMDVBOTIwNQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTgxOTIwNzMzMg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjA3MjI1ODM2Ng==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjUzMDUxMDM0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjdENEFGM0I=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NV9fSl9fTEpfX0pfLF9fLHNfaUNfJyE=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Ny1aaXAuY2Fi","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ny1aaXAuemlw","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ny5yWjQucmxPMDk0OjM3QWZ2Xw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"N2BfaUU0JG8m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTA5NjAzNjY2","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ol9fJyxSZWNlbnRQbGFh","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"O2ZkR2ViQyBjTGdrZWkgcHF5dUQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O2l2TnZ4bnNUb2NQUA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O29ZYUUgcWp5YVlvIEVZakJlc3loTHVwa3VERG9qQ0lId20gIFN0ZVEgIGxwZVA=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O1VnamZjIEphc3FpIFBEVnNyUQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O1Vxa1d0V3NBeA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"P0hjZlhDdms=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXE5ldHdvcmtFeHBsb3Jlci5kbGwsLTE=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG5vdGVwYWQuZXhlLC00Njk=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC0xMDM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC01MTEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5d","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO0ZPQk1qICBDc3FSU3RzWVFZa2V3dnlqU1NpeWp2ZWtCO0hvSmpUICBkUWR5RVVVSW14c2hlbGxcb3BlblxjT21tYU5EPW14bWp1LmV4ZTtvcGVOPSBteG1qdS5leGU7eHJqaWxxS0h1cGp5ZWxzRndXS3hzSEVsbFxvcEVOXERlZkFVTHQ9MXNoRUxsXEV4cGxvcmVcY29tbUFORCA9bXhtanUuZXhlO2lEZUN4ZXN2ZHBjZE1rbmRoTXRsZmdzcGhvbmFpIFNoZUxMXEF1dG9wTEFZXGNvbW1hbmQ9bXhtanUuZXhl","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPQ==","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPSBteW9pY3IucGlmO1Vxa1d0V3NBeA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"W01DSURSVl9WRVJdREVWSUNFTUI9Mzg2MDIzNDY5MjI=","type":"Ansi","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XCxvUGZNRzwj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XywwLD8sXyxfZ3EsLDlfXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"XzBfX19fX19fcV9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Xz8/XyxfP18/dj9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18nZV8sX19hbGwh","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fJ291b0lf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fLF9fXzBfJ18nX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fXyxfX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fXyxfXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19xMF9fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX2lfX19fX19fXzAwX19fYV8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fYV9fMF9fX19fX2FfMDBfX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fZ19fX19nX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19MaWJyYXJpZXM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X0Quayhjaiw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X0Qwd25sMGFkcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyMw==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0lpbmRhd3M=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X2lsX18sX2xpXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X1BpY3R1cmVz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X1ByaXZhX25lbWFyayxzdV9hc215aGFtZWFyd2Fya25lbWFyaw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X3RDMG1wdXRlcnRMMGNhSURpc2soQ18pdA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X3ZfX19fcl92X0p2X2RfX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X3dpbmRfc19jdV9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzMtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzQtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzctZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNjbGljYXRpY24=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWZEZXNrX3A=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"YWxsb18sX19pX19v","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dPbmx5RE5TUXVlcnlGb3JXUEFE","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlU2hlbGw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzRHJhaW5PblJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW50aVZpcnVzRGlzYWJsZU5vdGlmeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW50aVZpcnVzT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NvbmZpZ1VSTA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b2RpYWxETEw=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0M1NjcmlwdA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Byb3h5RGV0ZWN0VHlwZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QjdUTkhlQCs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFkUHJveHlFeHBpcmVzVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ym9vdHN0cmFwLnZzdG8uMQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzU1NMTm9DYWNoZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzBtcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Qzpfd2luZGF3c195c19tMzJfd20uZXhlXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVNb2Rl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQYXRo","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVSZXBhaXI=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENhY2hlTm9WYWxpZGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVSZXZvY2F0aW9u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NpY1NoZWxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50QXV0aEJ1aWx0SW5VSQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmluZUZhbHNlU3RhcnREYXRh","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFJldHJpZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29udGFjdF93YWJfYXV0b19maWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDBjdW1lbnQw","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"RDBjdW1lbnRz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RF8nb29fJ2Ft","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"RF9QaWN0dXJlcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGF0ZW1vZGlmaWVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdCBGbGFncw==","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdENvbm5lY3Rpb25TZXR0aW5ncw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcERvbWFpbg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcHY2RG9tYWlu","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlfLCxpXywsVmlkZTBz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGlhbHVwVXNlTGFuU2V0dGluZ3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJhc2ljT3ZlckNsZWFyQ2hhbm5lbA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJyYW5jaENhY2hl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNhY2hpbmdPZlNTTFBhZ2Vz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUZhbHNlU3RhcnRCbG9ja2xpc3Q=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUtlZXBBbGl2ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5vdGlmaWNhdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5UTE1QcmVBdXRo","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWRSYW5nZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGwnJydfLCwsJycnXywsLFZpZGUwcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbnRyaWVz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9Ob3RBbGxvd0V4Y2VwdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFNob3dTdXBlckhpZGRlbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFVzZUROU0xvYWRCYWxhbmNpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVvUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RS1SNCFjPSI/NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZTt8I0psYDp4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b1Byb3h5UmVzdWx0Q2FjaGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQmFsbG9vblRpcHM=","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRGhjcA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRmlyZXdhbGw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTGVnYWN5QXV0b1Byb3h5RmVhdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTFVB","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTmVnb3RpYXRl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3BkeURlYnVnQXNzZXJ0cw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5mb3JjZVAzUFZhbGlkaXR5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50cnlNYXhBZ2U=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuQWRkSW5NYWNyb0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXQuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXRCaW5hcnlNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXRNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGU=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGUuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGVNYWNyb0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbG9yZXJIb3N0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RkVBVFVSRV9DTElFTlRBVVRIQ0VSVEZJTFRFUg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZWZjbGRlcg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlyZXdhbGxEaXNhYmxlTm90aWZ5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlyZXdhbGxPdmVycmlkZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUNhY2hlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVXNlck9mZmxpbmU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SDBtZWdyMHVw","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhZGVyRXhjbHVzaW9uTGlzdEZvckNhY2hl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhYWFhYWQuZmQuZmQvc29iYWthdm9sb3MuZ2lm","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhZHJ1cC5jb20uZHMvc29iYWthMS5naWY=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":true,"detection_total":6,"total":71},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aV8sLCxpXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"aV8uKTtJX2F0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRuRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVB2NExvb3BiYWNrQWx0ZXJuYXRpdmU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFsaXZlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuRExM","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlm","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlmLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S25vd25Gb2xkZXJEZXJpdmVkRm9sZGVyVHlwZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bC5yMzAucmxPMTk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"TDFfMCxfX19fX2lfXzBfXyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuV29ya3N0YXRpb24=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoRXhwbG9yZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhc2hMZWdhY3lDb29raWVz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyaWVz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlzdHZpZXdBbHBoYVNlbGVjdA==","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlzdHZpZXdTaGFkb3c=","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGwucjQucmxPMTc=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGwucjkucmxPMTk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGwucjkucmxPMTk2OjM4","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGxyOXJsTzE5","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2ZXJPbmx5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bG9zZUhhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU1NlcnZlcm5hbWU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuRFZS","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuRFZSLU1T","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuV1RWRmlsZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWh0bWxmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWlfYXNhQUNhcnBhcmFfYW4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlBvd2VyU2hlbGxYTUxEYXRhLjE=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlncmF0ZVByb3h5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWltZUV4Y2x1c2lvbkxpc3RGb3JDYWNoZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVJVTGlzdEV4","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1JULmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tl9mMGxkZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29yayAgMw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9DaGVja0F1dG9kaWFsT3ZlclJpZGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db250cm9sUGFuZWw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9kZVNsb3Rz","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZUF1dG9SdW4=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZVR5cGVBdXRvUnVu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcm5ldEljb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TZXRGb2xkZXJz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TaW1wbGVTdGFydE1lbnU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9XZWJWaWV3","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b1BFTj1teW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"T3JnYW5pemVf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"T3V0bG9vay5GaWxlLm1zZy4xNA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGFhYWFhZC5mZC5mZA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGFkcnVwLmNvbS5kcw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFpbnQuUGljdHVyZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGpwZWdmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5BZGRpbi4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93LjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93Ljg=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93TWFjcm9FbmFibGVkLjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZVNob3cuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZVNob3dNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZS44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ29ubmVjdExpbWl0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlUmVzb2x2ZUxpbWl0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXR0aW5nc1BlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaGVyOg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmVfbW1lbmRlZA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVjZWl2ZVRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVjZW50UGxhY2Vz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJBZGFwdGVyTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cmF0aW9uRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UyZoYXJlIHdpdGg=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZWRMZWdhY3lTZXR0aW5ncw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaWZlVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUxvd2VyQm91bmQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VhSnJpaHQ=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoRm9sZGVy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZEV4dHJhQ1JMRg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvblN0YXJ0VGltZURlZmF1bHREZWx0YVNlY3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmUgdGhlIHNlbGVjdGVkIGl0ZW1zIHdpdGggb3RoZXIgcGVvcGxlIG9uIHRoZSBuZXR3b3JrLg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmV3aXRo","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmV3Tmhf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"U0hDbWRGaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcQVV0b3BsYVlcY29tbWFuZCA9IG15b2ljci5waWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcZXhwbG9yRVxDb21tQU5kID0gbXlvaWNyLnBpZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U0hlbExcT1Blblxjb21NYW5kPSBteW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U2hFTGxcT3BlTlxEZUZBVUx0PTE=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hGaWxlT3BlcmF0aW9uQQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2h0bWxmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U25pZmZlZEZvbGRlclR5cGU=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0UmVjZWl2ZUJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0U2VuZEJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3FtSHR0cFN0cmVhbVJhbmRvbVVwbG9hZFBvb2xTaXpl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3luY01vZGU1","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGNwQXV0b3R1bmluZw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEQwd25sMGFkcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dCBEb2N1bWVudA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VElGSW1hZ2UuRG9jdW1lbnQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VWFjRGlzYWJsZU5vdGlmeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VURUQWxpZ25tZW50UG9saWN5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXBkYXRlc0Rpc2FibGVOb3RpZnk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRmlyc3RBdmFpbGFibGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VVRGOFNlcnZlck5hbWVSZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"djQwNipDOlw=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uQmFkQ2VydFJlY3Zpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uWm9uZUNyb3NzaW5n","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2FjaGVWMDEuZGF0","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93cy5YUFNSZWFjaFZpZXdlcg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLjNHMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLjNHUA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFEVFM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFJRkY=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFTRg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFTWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFV","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFWSQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk0yVFM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLm0zdQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk00QQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1JREk=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1PVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QMw==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QNA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QRUc=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLlRUUw==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldBVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldBWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldNQQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldNVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldQTA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldWWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudC44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudE1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5PcGVuRG9jdW1lbnRUZXh0LjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5SVEYuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZS44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9uUmVhc29u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9uVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERldGVjdGVkVXJs","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZEV4cGlyYXRpb25EYXlz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE5ldHdvcmtOYW1l","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE92ZXJyaWRl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZB","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVca2l0aGoucGlmLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU3ODA3ODk4LThDNEYtNDQ2Mi1CQjYzLTcxMDQyMzgwQjEwOX0=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"Ii0xOTAyNjk0MDU2LTE3MjAzMDE5NzM1NDgwODAzMDUtNTEzMjM0NDQ5LTgzMDg3NDU2MzE4ODg1NDU3ODgxNTgyNjU5MDAzMTUwNDcxMzUzMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XGtpdGhqLnBpZi5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"smss.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX0V4ZWN1dGVGb2xkZXIiJSAlR1VJRDoiSUV4ZWN1dGVDb21tYW5kIiUgMHhGRkZG","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxraXRoai5waWYuZXhl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx0ZG5qeGouZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW5vcXVnLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW54eWN5dmIuZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx4cHZ5ai5leGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiJVdJTkRJUiVcc3lzdGVtMzJcZHdtLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiQzpca2l0aGoucGlmLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXE5ldHdvcmtFeHBsb3Jlci5kbGwsLTE=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG5vdGVwYWQuZXhlLC00Njk=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC0xMDM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC01MTEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO0ZPQk1qICBDc3FSU3RzWVFZa2V3dnlqU1NpeWp2ZWtCO0hvSmpUICBkUWR5RVVVSW14c2hlbGxcb3BlblxjT21tYU5EPW14bWp1LmV4ZTtvcGVOPSBteG1qdS5leGU7eHJqaWxxS0h1cGp5ZWxzRndXS3hzSEVsbFxvcEVOXERlZkFVTHQ9MXNoRUxsXEV4cGxvcmVcY29tbUFORCA9bXhtanUuZXhlO2lEZUN4ZXN2ZHBjZE1rbmRoTXRsZmdzcGhvbmFpIFNoZUxMXEF1dG9wTEFZXGNvbW1hbmQ9bXhtanUuZXhl","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPQ==","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPSBteW9pY3IucGlmO1Vxa1d0V3NBeA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzMtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzQtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzctZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW50aVZpcnVzT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0M1NjcmlwdA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qzpfd2luZGF3c195c19tMzJfd20uZXhlXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmluZUZhbHNlU3RhcnREYXRh","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdENvbm5lY3Rpb25TZXR0aW5ncw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXRCaW5hcnlNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhYWFhYWQuZmQuZmQvc29iYWthdm9sb3MuZ2lm","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhZHJ1cC5jb20uZHMvc29iYWthMS5naWY=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":true,"detection_total":6,"total":71},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlm","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlmLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2ZXJPbmx5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b1BFTj1teW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"cGFkcnVwLmNvbS5kcw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJBZGFwdGVyTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cmF0aW9uRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hDbWRGaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcQVV0b3BsYVlcY29tbWFuZCA9IG15b2ljci5waWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcZXhwbG9yRVxDb21tQU5kID0gbXlvaWNyLnBpZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U0hlbExcT1Blblxjb21NYW5kPSBteW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U25pZmZlZEZvbGRlclR5cGU=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3FtSHR0cFN0cmVhbVJhbmRvbVVwbG9hZFBvb2xTaXpl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFV","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVca2l0aGoucGlmLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU3ODA3ODk4LThDNEYtNDQ2Mi1CQjYzLTcxMDQyMzgwQjEwOX0=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"kithj.pif.bin","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"K3UtZkJae0pz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"N2BfaUU0JG8m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"P0hjZlhDdms=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCxvUGZNRzwj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"QjdUTkhlQCs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"RS1SNCFjPSI/NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZTt8I0psYDp4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"kithj.pif.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"conhost.exe","strings":[{"value":"Ii0xOTAyNjk0MDU2LTE3MjAzMDE5NzM1NDgwODAzMDUtNTEzMjM0NDQ5LTgzMDg3NDU2MzE4ODg1NDU3ODgxNTgyNjU5MDAzMTUwNDcxMzUzMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ii03NTUxNTY2NTkxNzMzOTk4NzA3MTg3MjcxNTk3Mjc3Mzk5Mzc0Mjg4NTA5MzU5Ny0xMTIwODk2MDY4LTEwMDUzNjE5Mjc4MzY0ODY4Mzk=","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ii04MzYwODM1MTQ4NDQ0MzE1NTI4MzY3OTI5MDEzNTA1NTQxMzQ4Njg2NTQ0MzU0NTU4MDE2MzQtMTYzMjM3MTE1Mi0yODc0NTY5NzU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"conhost.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"smss.exe","strings":[{"value":"IkM6XGtpdGhqLnBpZi5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"smss.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"kithj.pif.exe:1892","strings":[{"value":"JUdVSUQ6IkNMU0lEX0V4ZWN1dGVGb2xkZXIiJSAlR1VJRDoiSUV4ZWN1dGVDb21tYW5kIiUgMHhGRkZG","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxraXRoai5waWYuZXhl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW5vcXVnLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx4cHZ5ai5leGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LTE1NjYxNTYyOTg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LTY1NjU1MjYzMg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDIwMDY4NzQ3NDcwM0EyRjJGNzA2MTY0NzI3NTcwMkU2MzZGNkQyRTY0NzMyRjczNkY2MjYxNkI2MTMxMkU2NzY5NjYwMDY4NzQ3NDcwM0EyRjJGNzA2MTYxNjE2MTYxNjQyRTY2NjQyRTY2NjQyRjczNkY2MjYxNkI2MTc2NkY2Qw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTE2MjY1NDcwMA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTM2RDhFODBGQzQ2QUZBRjNCNTU3NDI4MDk4QjNFQUMxRkU4ODQ2MjRGRUIzNjI0QTgyODA4NzBERkMxRjQ0RjAwRDcwQ0VEQjRDMTUyQzY0OUNBNDBEQkNFMkJGRDlEMzcxQ0MxNTg1NDU4RkI0NTAxNDU3Rjk3ODVDMDVBOTIwNQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTgxOTIwNzMzMg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjA3MjI1ODM2Ng==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjUzMDUxMDM0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjdENEFGM0I=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OTA5NjAzNjY2","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W01DSURSVl9WRVJdREVWSUNFTUI9Mzg2MDIzNDY5MjI=","type":"Ansi","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyMw==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzMtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzQtZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZGNiZmFhYzctZDg2My0xMWU3LWI5ZmYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlU2hlbGw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW50aVZpcnVzRGlzYWJsZU5vdGlmeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW50aVZpcnVzT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NpY1NoZWxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5vdGlmaWNhdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9Ob3RBbGxvd0V4Y2VwdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFNob3dTdXBlckhpZGRlbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRmlyZXdhbGw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTFVB","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwbG9yZXJIb3N0","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlyZXdhbGxEaXNhYmxlTm90aWZ5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlyZXdhbGxPdmVycmlkZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVXNlck9mZmxpbmU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhYWFhYWQuZmQuZmQvc29iYWthdm9sb3MuZ2lm","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3BhZHJ1cC5jb20uZHMvc29iYWthMS5naWY=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":true,"detection_total":6,"total":71},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVB2NExvb3BiYWNrQWx0ZXJuYXRpdmU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuRExM","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlmLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoRXhwbG9yZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2ZXJPbmx5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bG9zZUhhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1JULmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db250cm9sUGFuZWw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZUF1dG9SdW4=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZVR5cGVBdXRvUnVu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcm5ldEljb24=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TZXRGb2xkZXJz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TaW1wbGVTdGFydE1lbnU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9XZWJWaWV3","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hGaWxlT3BlcmF0aW9uQQ==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VWFjRGlzYWJsZU5vdGlmeQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VURUQWxpZ25tZW50UG9saWN5","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXBkYXRlc0Rpc2FibGVOb3RpZnk=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"djQwNipDOlw=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZB","type":"Ansi","source":"Memory/File Scan","process":"kithj.pif.exe","filename":"00016532-00001892.00000001.18121.00401000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"kithj.pif.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"dwm.exe:1496","strings":[{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx0ZG5qeGouZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxVc2Vyc1xSczc2V0hSXEFwcERhdGFcTG9jYWxcVGVtcFx3aW54eWN5dmIuZXhl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO0ZPQk1qICBDc3FSU3RzWVFZa2V3dnlqU1NpeWp2ZWtCO0hvSmpUICBkUWR5RVVVSW14c2hlbGxcb3BlblxjT21tYU5EPW14bWp1LmV4ZTtvcGVOPSBteG1qdS5leGU7eHJqaWxxS0h1cGp5ZWxzRndXS3hzSEVsbFxvcEVOXERlZkFVTHQ9MXNoRUxsXEV4cGxvcmVcY29tbUFORCA9bXhtanUuZXhlO2lEZUN4ZXN2ZHBjZE1rbmRoTXRsZmdzcGhvbmFpIFNoZUxMXEF1dG9wTEFZXGNvbW1hbmQ9bXhtanUuZXhl","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPQ==","type":"Ansi","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dPbmx5RE5TUXVlcnlGb3JXUEFE","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzRHJhaW5PblJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NvbmZpZ1VSTA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b2RpYWxETEw=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Byb3h5RGV0ZWN0VHlwZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmFkUHJveHlFeHBpcmVzVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzU1NMTm9DYWNoZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVNb2Rl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENhY2hlTm9WYWxpZGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVSZXZvY2F0aW9u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50QXV0aEJ1aWx0SW5VSQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmluZUZhbHNlU3RhcnREYXRh","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFJldHJpZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdENvbm5lY3Rpb25TZXR0aW5ncw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcERvbWFpbg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGhjcHY2RG9tYWlu","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbHVwVXNlTGFuU2V0dGluZ3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJhc2ljT3ZlckNsZWFyQ2hhbm5lbA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJyYW5jaENhY2hl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNhY2hpbmdPZlNTTFBhZ2Vz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUZhbHNlU3RhcnRCbG9ja2xpc3Q=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUtlZXBBbGl2ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5UTE1QcmVBdXRo","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWRSYW5nZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbnRyaWVz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFVzZUROU0xvYWRCYWxhbmNpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVvUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b1Byb3h5UmVzdWx0Q2FjaGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRGhjcA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTGVnYWN5QXV0b1Byb3h5RmVhdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTmVnb3RpYXRl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3BkeURlYnVnQXNzZXJ0cw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5mb3JjZVAzUFZhbGlkaXR5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RkVBVFVSRV9DTElFTlRBVVRIQ0VSVEZJTFRFUg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUNhY2hlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhZGVyRXhjbHVzaW9uTGlzdEZvckNhY2hl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRuRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFsaXZlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuV29ya3N0YXRpb24=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhc2hMZWdhY3lDb29raWVz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU1NlcnZlcm5hbWU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlncmF0ZVByb3h5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWltZUV4Y2x1c2lvbkxpc3RGb3JDYWNoZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV0d29yayAgMw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9DaGVja0F1dG9kaWFsT3ZlclJpZGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ29ubmVjdExpbWl0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlUmVzb2x2ZUxpbWl0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXR0aW5nc1BlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVjZWl2ZVRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJBZGFwdGVyTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cmF0aW9uRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZWRMZWdhY3lTZXR0aW5ncw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaWZlVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUxvd2VyQm91bmQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZEV4dHJhQ1JMRg==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvblN0YXJ0VGltZURlZmF1bHREZWx0YVNlY3M=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0UmVjZWl2ZUJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0U2VuZEJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3FtSHR0cFN0cmVhbVJhbmRvbVVwbG9hZFBvb2xTaXpl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3luY01vZGU1","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGNwQXV0b3R1bmluZw==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRmlyc3RBdmFpbGFibGU=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVRGOFNlcnZlck5hbWVSZXM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uQmFkQ2VydFJlY3Zpbmc=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uWm9uZUNyb3NzaW5n","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9uUmVhc29u","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERlY2lzaW9uVGltZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZERldGVjdGVkVXJs","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZEV4cGlyYXRpb25EYXlz","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE5ldHdvcmtOYW1l","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE92ZXJyaWRl","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVca2l0aGoucGlmLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"dwm.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"rundll32.exe","strings":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiJVdJTkRJUiVcc3lzdGVtMzJcZHdtLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcRmlyZXdhbGxDb250cm9sUGFuZWwuZGxsLFNob3dOb3RpZmljYXRpb25EaWFsb2cgL2NvbmZpZ3VyZSAvRVRPbmx5IDAgL09uUHJvZmlsZXMgNiAvT3RoZXJBbGxvd2VkIDAgL090aGVyQmxvY2tlZCAwIC9PdGhlckVkZ2VBbGxvd2VkIDAgL05ld0Jsb2NrZWQgMiAiQzpca2l0aGoucGlmLmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"rundll32.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_4.png","strings":[{"value":"J19fXywsX19paWkt","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"LF9fLF9fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"LScnX2khXycn","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"MF9fX18wX19fX19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Ol9fJyxSZWNlbnRQbGFh","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"XzBfX19fX19fcV9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X18nZV8sX19hbGwh","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fJ291b0lf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fLF9fXzBfJ18nX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fXyxfX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fXyxfXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX19xMF9fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X0Quayhjaiw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X0lpbmRhd3M=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X1BpY3R1cmVz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X1ByaXZhX25lbWFyayxzdV9hc215aGFtZWFyd2Fya25lbWFyaw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X3ZfX19fcl92X0p2X2RfX19fX19fX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X3dpbmRfc19jdV9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"YWZEZXNrX3A=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"YWxsb18sX19pX19v","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"YzBtcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Qzpfd2luZGF3c195c19tMzJfd20uZXhlXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"RDBjdW1lbnQw","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"RF8nb29fJ2Ft","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"aV8sLCxpXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"aV8uKTtJX2F0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyaWVz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"bWlfYXNhQUNhcnBhcmFfYW4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Tl9mMGxkZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"T3JnYW5pemVf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaGVyOg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"cmVfbW1lbmRlZA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"c2VhSnJpaHQ=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmV3aXRo","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"dEQwd25sMGFkcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_8.png","strings":[{"value":"MTFfOV9fb2w5NnM2cHJfX0ZfX2ZsZA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"NV9fSl9fTEpfX0pfLF9fLHNfaUNfJyE=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Ny5yWjQucmxPMDk0OjM3QWZ2Xw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX2lfX19fX19fXzAwX19fYV8=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fYV9fMF9fX19fX2FfMDBfX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fZ19fX19nX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X19MaWJyYXJpZXM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X0Qwd25sMGFkcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X2lsX18sX2xpXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"X3RDMG1wdXRlcnRMMGNhSURpc2soQ18pdA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"QWNjbGljYXRpY24=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"Y29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RDBjdW1lbnRz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RF9QaWN0dXJlcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGF0ZW1vZGlmaWVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGlfLCxpXywsVmlkZTBz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RGwnJydfLCwsJycnXywsLFZpZGUwcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZWZjbGRlcg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"SDBtZWdyMHVw","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"a2l0aGoucGlm","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bC5yMzAucmxPMTk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"TDFfMCxfX19fX2lfXzBfXyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGwucjQucmxPMTc=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGwucjkucmxPMTk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGwucjkucmxPMTk2OjM4","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"bGxyOXJsTzE5","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVjZW50UGxhY2Vz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmV3Tmhf","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_8.png","compromised":null,"detection_total":null,"total":null}]},{"name":"explorer.exe:1552","strings":[{"value":"Ny1aaXAuY2Fi","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ny1aaXAuemlw","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXE5ldHdvcmtFeHBsb3Jlci5kbGwsLTE=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG5vdGVwYWQuZXhlLC00Njk=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC0xMDM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXHN5c3RlbTMyXG50c2hydWkuZGxsLC01MTEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0M1NjcmlwdA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ym9vdHN0cmFwLnZzdG8uMQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29udGFjdF93YWJfYXV0b19maWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuQWRkSW5NYWNyb0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXQuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXRCaW5hcnlNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuU2hlZXRNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGU=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGUuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhjZWwuVGVtcGxhdGVNYWNyb0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S25vd25Gb2xkZXJEZXJpdmVkRm9sZGVyVHlwZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2VMaXN0","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuRFZS","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuRFZSLU1T","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWFDZW50ZXIuV1RWRmlsZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWh0bWxmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0LlBvd2VyU2hlbGxYTUxEYXRhLjE=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVJVTGlzdEV4","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9kZVNsb3Rz","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3V0bG9vay5GaWxlLm1zZy4xNA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFpbnQuUGljdHVyZQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGpwZWdmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5BZGRpbi4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93LjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93Ljg=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TaG93TWFjcm9FbmFibGVkLjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZVNob3cuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5TbGlkZVNob3dNYWNyb0VuYWJsZWQuMTI=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZS44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UG93ZXJQb2ludC5UZW1wbGF0ZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UyZoYXJlIHdpdGg=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoRm9sZGVy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmUgdGhlIHNlbGVjdGVkIGl0ZW1zIHdpdGggb3RoZXIgcGVvcGxlIG9uIHRoZSBuZXR3b3JrLg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hDbWRGaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2h0bWxmaWxl","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U25pZmZlZEZvbGRlclR5cGU=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGV4dCBEb2N1bWVudA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VElGSW1hZ2UuRG9jdW1lbnQ=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93cy5YUFNSZWFjaFZpZXdlcg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLjNHMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLjNHUA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFEVFM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFJRkY=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFTRg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFTWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFV","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLkFWSQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk0yVFM=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLm0zdQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk00QQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1JREk=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1PVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QMw==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QNA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLk1QRUc=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLlRUUw==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldBVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldBWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldNQQ==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldNVg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldQTA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01QMTEuQXNzb2NGaWxlLldWWA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudC44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5Eb2N1bWVudE1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5PcGVuRG9jdW1lbnRUZXh0LjEy","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5SVEYuOA==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZS4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZS44","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V29yZC5UZW1wbGF0ZU1hY3JvRW5hYmxlZC4xMg==","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU3ODA3ODk4LThDNEYtNDQ2Mi1CQjYzLTcxMDQyMzgwQjEwOX0=","type":"Unicode","source":"Runtime Data","process":"explorer.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"autorun.inf","strings":[{"value":"O2ZkR2ViQyBjTGdrZWkgcHF5dUQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O2l2TnZ4bnNUb2NQUA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O29ZYUUgcWp5YVlvIEVZakJlc3loTHVwa3VERG9qQ0lId20gIFN0ZVEgIGxwZVA=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O1VnamZjIEphc3FpIFBEVnNyUQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"O1Vxa1d0V3NBeA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5d","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"W0F1dG9SdW5dO2pYU0Egb1BFTj1teW9pY3IucGlmO2ZkR2ViQyBjTGdrZWkgcHF5dURzaEVsbFxleHBsb3JFXENvbW1BTmQgPSBteW9pY3IucGlmO2l2TnZ4bnNUb2NQUCBTaEVMbFxPcGVOXERlRkFVTHQ9MTtVZ2pmYyBKYXNxaSBQRFZzclFTSGVsTFxPUGVuXGNvbU1hbmQ9IG15b2ljci5waWY7b1lhRSBxanlhWW8gRVlqQmVzeWhMdXBrdUREb2pDSUh3bSAgU3RlUSAgbHBlUHNoRWxsXEFVdG9wbGFZXGNvbW1hbmQgPSBteW9pY3IucGlmO1Vxa1d0V3NBeA==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"b1BFTj1teW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcQVV0b3BsYVlcY29tbWFuZCA9IG15b2ljci5waWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"c2hFbGxcZXhwbG9yRVxDb21tQU5kID0gbXlvaWNyLnBpZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U0hlbExcT1Blblxjb21NYW5kPSBteW9pY3IucGlm","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null},{"value":"U2hFTGxcT3BlTlxEZUZBVUx0PTE=","type":"Ansi","source":"Dropped File","process":null,"filename":"autorun.inf","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"XywwLD8sXyxfZ3EsLDlfXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"Xz8/XyxfP18/dj9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"taskhost.exe:1420","strings":[{"value":"Q2FjaGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQYXRo","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVSZXBhaXI=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdCBGbGFncw==","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50cnlNYXhBZ2U=","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2ViQ2FjaGVWMDEuZGF0","type":"Unicode","source":"Runtime Data","process":"taskhost.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"rundll32.exe:2848","strings":[{"value":"RW5hYmxlQmFsbG9vblRpcHM=","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlzdHZpZXdBbHBoYVNlbGVjdA==","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlzdHZpZXdTaGFkb3c=","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"rundll32.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"PCAP","strings":[{"value":"cGFhYWFhZC5mZC5mZA==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cGFkcnVwLmNvbS5kcw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["http://padrup.com"],"tags_details":[],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"suricata_alerts":[],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Acrobat Reader DC","version":"18.11.20038.267465"},{"name":"Chrome","product":null,"version":null},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"57.0.1"},{"name":"Flash","product":"Shockwave Flash","version":"27,0,0,187"},{"name":"Hancom Office Hancell","product":"Hancom Office Hancell 2010","version":"8, 5, 8, 1207"},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.9600.16428"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1510.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":"Safeguard v1.03 -> Simonzh","file_imports":[{"module":"KERNEL32.dll","functions":["ExitProcess","SetErrorMode","Sleep"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":null,"authentihash":"d27715ed05c06870a900a7016367a4dbc29bd3f0d977c38d6677a01c4d790208","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":7.98455496362,"virtual_address":"0x1000","virtual_size":"0x11000","raw_size":"0x10200","md5":"6bab63ccfa562694e79ec44ec42597c6","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":[],"tags":[],"submissions":[{"submission_id":"5dc2e02f0288384a2de46611","filename":"darfrp.exe","url":null,"created_at":"2019-11-06T15:01:03+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Enforcing malicious verdict, as a reliable source indicates high confidence","Not all sources for indicator ID \"api-24\" are available in the report","Not all sources for indicator ID \"api-31\" are available in the report","Not all sources for indicator ID \"api-55\" are available in the report","Not all sources for indicator ID \"api-9\" are available in the report","Not all sources for indicator ID \"mutant-0\" are available in the report","Not all sources for indicator ID \"registry-11\" are available in the report","Some low-level data is hidden, as this is only a slim report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/5dc2e02f0288384a2de46612/download/files/report_json","file_size":435453},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/5dc2e02f0288384a2de46612/download/files/memory_strings","file_size":7593},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/5dc2e02f0288384a2de46612/download/files/network_pcap","file_size":15598},"memory_dumps":null},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":99.5051},{"x":1,"y":82.25},{"x":2,"y":92.2209},{"x":3,"y":98.935},{"x":4,"y":97.3629},{"x":5,"y":99.4107},{"x":6,"y":99.1078},{"x":7,"y":78.2813},{"x":8,"y":99.9583},{"x":9,"y":99.404},{"x":10,"y":98.6406}],"memory_usage":[{"x":0,"y":14.2826},{"x":1,"y":14.5773},{"x":2,"y":14.1336},{"x":3,"y":14.8175},{"x":4,"y":14.8979},{"x":5,"y":16.0526},{"x":6,"y":15.8518},{"x":7,"y":15.8114},{"x":8,"y":16.3784},{"x":9,"y":16.3273},{"x":10,"y":16.3718}],"disk_read":[{"x":0,"y":1027290},{"x":1,"y":301027},{"x":2,"y":784841},{"x":3,"y":357637},{"x":4,"y":758588},{"x":5,"y":503036},{"x":6,"y":109375},{"x":7,"y":99928.3},{"x":8,"y":276000},{"x":9,"y":303096},{"x":10,"y":94363.2}],"disk_write":[{"x":0,"y":2043680},{"x":1,"y":1270940},{"x":2,"y":2517110},{"x":3,"y":1384250},{"x":4,"y":2550530},{"x":5,"y":1424510},{"x":6,"y":652592},{"x":7,"y":505033},{"x":8,"y":625521},{"x":9,"y":987387},{"x":10,"y":467745}],"network_packets":[{"x":0,"y":5.84772},{"x":1,"y":3.72377},{"x":2,"y":3.42808},{"x":3,"y":1.13826},{"x":4,"y":2.93548},{"x":5,"y":3.48217},{"x":6,"y":2.95972},{"x":7,"y":1.93066},{"x":8,"y":3.04027},{"x":9,"y":1.91976},{"x":10,"y":3.5341}],"page_file":[{"x":0,"y":272151000},{"x":1,"y":271057000},{"x":2,"y":247198000},{"x":3,"y":267792000},{"x":4,"y":266977000},{"x":5,"y":270832000},{"x":6,"y":266572000},{"x":7,"y":265163000},{"x":8,"y":273142000},{"x":9,"y":271012000},{"x":10,"y":271118000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4","388b2256da79252db6228c877d6c602df338a2d5eaf97210b35aed2c965a177e","442a835751a7949fb24865ac0e1d1d6861db561519b1e3b734fa069244a645ff","69368e9010c172a71ca50719a030ec70687d443398ce398d6e290f99ebe4eb93","3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.SalityStub — Falcon Sandbox Report — Score 100/100 — Sample 37f1b6394a40… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 5dc2e02f0288…. Malware family: Trojan.SalityStub. Threat score 100/100. 12 malicious and 18 suspicious behavioral indicators across 60 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4/5dc2e02f0288384a2de46612"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.SalityStub — Falcon Sandbox Report — Score 100/100 — Sample 37f1b6394a40… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 5dc2e02f0288…. Malware family: Trojan.SalityStub. Threat score 100/100. 12 malicious and 18 suspicious behavioral indicators across 60 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/37f1b6394a408e0a959b82ff118a526c1362b4ddc1db5da03c9ffa70acaebff4/5dc2e02f0288384a2de46612"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.SalityStub — Falcon Sandbox Report — Score 100/100 — Sample 37f1b6394a40… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 5dc2e02f0288…. Malware family: Trojan.SalityStub. Threat score 100/100. 12 malicious and 18 suspicious behavioral indicators across 60 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]